« Volver al listado

CVE-2026-98135

Estado: En análisisSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid sectors_per_cluster in the boot sector

is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():

ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the shift is undefined:

This change rejects any non-power-of-two value, since it feeds the aforementioned shift via ffs() - 1, which only yields the correct shift for a power of two.

Detalles técnicos trazas, registros y código del informe original
	sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;
	...
	vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;

  UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39
  shift exponent 4294967295 is too large for 32-bit type 'int'

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98135",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
              "lessThan": "7524c3145a3bac92bebbc47a29c007f1d874c9b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
              "lessThan": "323751a604e7533fa473874d999371592a614207",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ntfs/super.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ntfs/super.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:44.933",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/323751a604e7533fa473874d999371592a614207",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7524c3145a3bac92bebbc47a29c007f1d874c9b3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: reject invalid sectors_per_cluster in the boot sector\n\nis_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field\nwith a range test that rejects 0x81..0xf3 but accepts 0 and other\nnon-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():\n\n\tsectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;\n\t...\n\tvol->cluster_size = vol->sector_size << sectors_per_cluster_bits;\n\nffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the\nshift is undefined:\n\n  UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39\n  shift exponent 4294967295 is too large for 32-bit type 'int'\n\nThis change rejects any non-power-of-two value, since it feeds the\naforementioned shift via ffs() - 1, which only yields the correct shift for a\npower of two."
    }
  ],
  "lastModified": "2026-09-30T14:10:59.253",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}