{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: only count successfully cleared runs when freeing clusters  ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed - e.g. a second run failing with the same errno as an earlier one, or any failure after a non-ENOMEM error was already recorded. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol-\u003efree_clusters, corrupting statfs output and the allocator's free space gate.  Only count runs whose bitmap clear succeeded.",
  "id": "DEBIAN-CVE-2026-98139",
  "modified": "2026-09-26T04:47:33.092197485Z",
  "published": "2026-09-25T11:17:45.383Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98139"
    }
  ],
  "upstream": [
    "CVE-2026-98139"
  ]
}