CVE-2026-89610

The Linux kernel's NTFS mapping-pairs decoder validated only that a run's starting cluster (LCN) fell inside the volume, but never checked that lcn + run length stayed within the total cluster count (nr_clusters). By mounting a malformed NTFS image with a crafted mapping pairs array, an attacker makes the kernel access memory beyond the volume's boundary, which can lead to kernel memory corruption and potential privilege escalation to kernel/root privileges. The attack requires the victim system to mount attacker-supplied NTFS media, such as a USB stick, disk image, or a filesystem exported to it. Any Linux system with the NTFS driver enabled that mounts untrusted NTFS filesystems is affected, though no specific vulnerable or fixed version numbers were provided in the source data. There is no known public proof of concept and the issue is not on CISA's KEV, so exploitation is currently none known.

What to do: Apply distribution kernel updates containing this fix as soon as they ship and reboot into the patched kernel. Until patched, disable automatic mounting of untrusted USB media and unprivileged mounting of NTFS disk images, and check whether the NTFS driver is even enabled in your kernel configuration — disable NTFS support on systems that never need to read such media.