CVE-2026-98135

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NTFS driver where the is boot sector ntfs() function fails to properly validate the sectors per cluster field in the boot sector. While it rejects values between 0x81 and 0xf3, it accepts 0 and other non-power-of-two counts. When a zero value is passed to the parse ntfs boot sector() function, the ffs() function returns 0, causing the sectors per cluster bits variable to become (unsigned)-1. This results in an undefined shift-out-of-bounds operation when calculating vol->cluster size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.