CVE-2026-89612

Received Received - Intake

NTFS Boot Sector MFT LCN Validation Flaw

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89612

EUVD

EUVD-2026-76524

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of NTFS boot sector data. The NTFS boot sector stores locations of the Master File Table (MFT) and its mirror as unsigned 64-bit values. However, the kernel's parsing function incorrectly converted these to signed 64-bit integers. A crafted value with a high bit set could become negative, bypassing security checks and leading to an out-of-bounds memory access in the MFT zone allocator.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem handling. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version. If your system uses NTFS, inspect the kernel logs for NTFS-related errors or crashes.

Impact Analysis

This flaw could allow an attacker with local access to trigger memory corruption in the Linux kernel. This might lead to system crashes, privilege escalation, or arbitrary code execution, potentially compromising the entire system's security and stability.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Avoid mounting untrusted NTFS filesystems until the kernel is updated. If immediate patching is not possible, disable NTFS support or restrict access to untrusted storage devices.

Hi! I’m here to help you understand CVE-2026-89612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70