Riskcovery

CVE-2026-90134

ntfs: fix kmap_local_page() usage in compress

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix kmap_local_page() usage in compress

Several compressed I/O paths discard the address returned by kmap_local_page() and later access or unmap the page using page_address(). This is invalid for highmem pages, and local mappings must also be unmapped using the address returned by kmap_local_page().

Map each destination page in ntfs_decompress() only while producing the current sub-block. Use memcpy_from_page(), memcpy_to_page(), and memzero_page() for the other page accesses. Remove unnecessary local mappings from ntfs_write_cb(), where pages are accessed through the vmap() mapping.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 495e90fa334828d4119061e2726af51d0a0fb4ed to before 950e2ecc7aec21af24b05bc661a097a81c670409Affected
  • 495e90fa334828d4119061e2726af51d0a0fb4ed to before 6e03fbd5f772ad24ea64f7632e4d0d73184787caAffected
LinuxLinux
  • 7.1Affected
  • before 7.1Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.