CVE-2026-90117

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NTFS driver where the ntfs mft record alloc() function fails to validate the usa ofs variable before using it to read the update sequence number from an on-disk record. Because usa ofs is an untrusted 16-bit unsigned integer, a corrupted record can cause the read operation to occur outside the memory bounds of the page-cache folio, potentially leading to a use-after-free condition during file creation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.