CVE-2026-89612

The Linux kernel's legacy NTFS driver (fs/ntfs) mishandles the MFT and MFTMirr location fields in the NTFS boot sector: parse_ntfs_boot_sector() decoded the unsigned 64-bit LCN values into a signed s64, so a crafted high-bit value becomes negative and slips past the existing upper-bound validation. The invalid LCN then propagates into the MFT zone allocator, where it can cause an out-of-bounds access to lcn_empty_bits_per_page, corrupting kernel memory. The flaw is triggered whenever the kernel parses a maliciously crafted NTFS boot sector — in practice when a victim system mounts an attacker-supplied NTFS volume such as a USB drive, disk image, or virtual-machine image. Successful exploitation yields kernel memory corruption on the target (rated CVSS 9.8 in the source data), which in realistic scenarios is a local crash-to-potential-privilege-escalation rather than a remotely reachable flaw, despite the network vector in the published score. No public proof-of-concept exists, the issue is not in the CISA KEV catalog, and no exploitation in the wild is known.

What to do: Apply kernel updates from your distro containing the upstream ntfs fix once available, and reboot into the patched kernel. As mitigation, avoid mounting untrusted NTFS volumes (USB media, downloaded disk/VM images) and consider disabling the legacy read-only ntfs driver (CONFIG_NTFS_FS) in favor of ntfs3 or ntfs-3g where possible. Check fleet kernel versions and mount policies for removable media, and audit for any automated mounting of externally supplied NTFS filesystems.