CVE-2026-89610

Received Received - Intake

NTFS Volume Boundary Memory Corruption

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation. Add validation to ensure lcn + length stays within nr_clusters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89610

EUVD

EUVD-2026-76522

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the NTFS file system. The issue occurs in the mapping pairs decoder, which checks if the starting location is within the volume but fails to verify if the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory outside the volume, potentially leading to memory corruption and privilege escalation.

Detection Guidance

This vulnerability involves a malformed NTFS image causing memory corruption. Detection requires inspecting NTFS images or kernel logs for crafted mapping pairs. Check kernel logs for NTFS-related errors or crashes using: dmesg | grep -i ntfs. Scan systems for NTFS images with tools like fsck or ntfsfix to identify malformed structures.

Impact Analysis

This vulnerability could allow an attacker to corrupt memory or escalate privileges on a system running a vulnerable Linux kernel. If exploited, it may lead to unauthorized access, data breaches, or system crashes. Users should update their kernels to mitigate the risk.

Compliance Impact

This vulnerability could lead to memory corruption and privilege escalation by allowing access beyond volume boundaries in NTFS images. Such unauthorized memory access may compromise system integrity, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is exposed or altered.

Mitigation Strategies

Apply the latest Linux kernel patches to address the NTFS validation issue. Avoid mounting untrusted NTFS images until patched. Monitor kernel updates from your distribution and update promptly. Disable NTFS support if not required.

Hi! I’m here to help you understand CVE-2026-89610. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70