CVE-2026-90134 ntfs: fix kmap_local_page() usage in compress
A memory corruption flaw in the Linux kernel NTFS driver allows local attackers to cause denial of service or execute arbitrary code via improper page mapping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90134?
CVE-2026-90134 is a memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix kmap_local_page() usage in compress
Several compressed I/O paths discard the address returned by kmap_local_page() and later access or unmap the page using page_address(). This is invalid for highmem pages, and local mappings must also be unmapped using the address returned by kmap_local_page().
Map each destination page in ntfs_decompress() only while producing the current sub-block. Use memcpy_from_page(), memcpy_to_page(), and memzero_page() for the other page accesses. Remove unnecessary local mappings from ntfs_write_cb(), where pages are accessed through the vmap() mapping.
Which versions are affected by CVE-2026-90134?
How do I fix CVE-2026-90134?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90134 being exploited?
There is no known exploitation of CVE-2026-90134 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-90134, GHSA-8xqc-mr32-5fw8, UBUNTU-CVE-2026-90134.