CVE-2026-90199

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mi enum attr() function within the ntfs3 file system. The validation for start and end Virtual Cluster Numbers (VCN) for non-resident attributes is insufficient. When the evcn variable is set to U64 MAX, the expression evcn + 1 wraps around to 0, allowing any svcn value to pass the check. Additionally, evcn values close to U64 MAX can create a meaningless upper bound, allowing malformed on-disk attributes with svcn equal to 0 to bypass validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.