CVE-2026-89779

The Linux kernel's ntfs3 filesystem driver fails to verify that an NTFS extended-attribute (EA) record's ef->size field is large enough to hold the record's own name and value, so a crafted image can pass validation in ntfs_read_ea() with a declared size of, e.g., 24 bytes while embedding a length (elength) of 0xffff. When getxattr() is later called on a file on that mounted image, ntfs_get_ea() trusts the bogus elength and copies up to 64 KB out of the undersized kmalloc'd buffer, producing a slab out-of-bounds read (confirmed by the KASAN report) that leaks adjacent kernel heap memory to userspace. An attacker who can get a malicious NTFS image or device mounted, for example via a USB drive auto-mounted on a desktop or a service that processes untrusted disk images, can disclose kernel heap contents, and the CVSS 9.1 rating (C:H/A:H) also reflects potential denial of service. Any Linux system running a kernel with the ntfs3 driver (CONFIG_NTFS3) enabled that mounts untrusted NTFS filesystems is affected. No public proof-of-concept is known, there is no reported in-the-wild exploitation, and the issue is not in CISA's KEV catalog.

What to do: Update the kernel via your distribution's security channel as fixes ship (the patch makes ntfs_get_ea()/ntfs_read_ea() require ef->size to cover the record's name and value); fixed version numbers were not provided in the advisory. Until patched, avoid mounting untrusted NTFS images or USB devices with the in-kernel ntfs3 driver (prefer the FUSE-based ntfs-3g) and restrict mount privileges to trusted users. Check whether CONFIG_NTFS3 is enabled or the ntfs3 module is loaded on your systems to gauge exposure.