CVE-2026-89616

The Linux kernel's NTFS3 filesystem driver fails to zero the tail of a decompressed frame in ni_read_frame(): when decompress_lznt() exhausts the compressed stream early, it returns fewer bytes than the frame size, and the driver marks all pages uptodate without clearing the gap. A crafted NTFS file whose LZNT stream decompresses to only a few bytes causes a plain read(2) to disclose the unwritten tail — recently freed kernel page memory — to unprivileged userspace. Leaked content can reveal kernel pointers and defeat KASLR, providing reconnaissance for follow-on kernel exploitation. Any Linux system that mounts an NTFS filesystem with the in-kernel ntfs3 driver and reads such a file is affected; the issue is rated CVSS 3.1 7.5 (high) with a network attack vector, since a malicious NTFS image can be delivered remotely (downloaded image, network share) and mounted by the victim. The flaw is fixed upstream by zeroing the [unc_size, frame_size) tail after a successful LZNT decompression, and no public PoC or in-the-wild exploitation is known.

What to do: Install a kernel that backports the fs/ntfs3 fix (which zeroes the [unc_size, frame_size) tail immediately after a successful LZNT decompression) as soon as your distribution ships it. Until patched, avoid mounting untrusted NTFS disk images or removable media with the in-kernel ntfs3 driver — disable CONFIG_NTFS3, prefer the userspace ntfs-3g driver, or block automounting of NTFS media. Note that only systems with the ntfs3 driver compiled in or loaded as a module and actually reading NTFS volumes are exposed, so servers without NTFS mounts carry minimal practical risk.