CVE-2026-89613

CVE-2026-89613 is a vulnerability in the Linux kernel's legacy ntfs filesystem driver, fixed by a change titled "ntfs: reject invalid empty mapping pairs." The driver fails to reject an attribute whose mapping pairs are empty while its highest VCN and size fields are inconsistent, allowing crafted on-disk NTFS metadata to drive out-of-bounds access and memory corruption during parsing. The flaw is triggered when the kernel mounts or processes a maliciously crafted NTFS filesystem image, for example via an inserted USB device, automount, or any path that hands attacker-controlled NTFS media to the in-kernel driver. Successful exploitation could crash the machine or lead to kernel-level code execution (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), though practical attack paths generally require getting a crafted filesystem mounted. All Linux systems whose kernels include and use the legacy ntfs driver are affected; no public proof of concept is known and there is no evidence of in-the-wild exploitation.

What to do: Apply kernel updates from your distribution once the fix for CVE-2026-89613 is included, and verify the running kernel post-reboot. If the legacy in-kernel ntfs driver is not needed, blacklist the ntfs module or ensure NTFS mounts use the ntfs3 or userspace ntfs-3g driver instead. Restrict automounting of untrusted USB/removable media on servers and multi-user desktops to block the main delivery path for crafted filesystem images.