CVE-2026-89611
massOut-of-Bounds Write in Linux Kernel NTFS Driver via Crafted Filesystem Metadata
The Linux kernel's NTFS filesystem driver fails to validate the name_offset field of non-resident attributes in MFT records before ntfs_attr_update_meta() converts an attribute between non-sparse and sparse form. A maliciously crafted NTFS volume can position the attribute name at the very end of the record or overlapping the mapping pairs, so the conversion shifts the name 8 bytes past the attribute boundary, corrupting adjacent kernel memory. Successful exploitation yields kernel memory corruption that can crash the machine or potentially lead to privilege escalation, though the attack requires the victim system to mount an attacker-supplied NTFS filesystem (e.g., a USB drive, disk image, or network-attached volume). Any Linux system whose kernel includes the ntfs driver and mounts NTFS media from untrusted sources is affected; the CVSS 9.8 network vector reflects remote-mount scenarios such as network block devices or automated disk-image processing. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and there is no evidence of in-the-wild exploitation.
What to do: Patch to a kernel release containing the upstream fix for CVE-2026-89611 as soon as your distribution ships it. In the meantime, prevent mounting of untrusted NTFS volumes: disable automounting of removable media, block the ntfs kernel module (e.g., modprobe blacklist) on hosts that never need it, and route untrusted NTFS disks through the userspace ntfs-3g/FUSE driver so malformed metadata cannot corrupt kernel memory. Audit systems that accept external disks, VM images, or network block devices for exposure, and watch for kernel oops/panic signatures originating in fs/ntfs.
| Linux kernel (NTFS filesystem driver, fs/ntfs) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record. However, the validator does not check that name_offset is within safe boundaries for these operations or that the additional space is available. A malicious MFT record could set name_offset such that: 1. The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary. 2. The name overlaps with the mapping pairs, causing corruption during conversion. Add validation to ensure: - For named attributes, name_offset is within valid bounds - Name does not extend beyond the attribute or overlap with mapping pairs - For non-sparse, non-compressed attributes, eight bytes are available after mapping_pairs_offset for the compressed_size field The space check also covers unnamed attributes, for which name_offset = 0 is valid and no name range needs to be checked.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.