CVE-2026-89615

Received Received - Intake

Buffer Overflow in Linux Kernel NTFS3 Filesystem

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log record The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i, where i runs up to the log record's lcns_follow. That count is checked only against the record's own length, not the target entry, so check_dp_table() (which validates the entry's lcns_follow) does not cover it: the copy_lcns entry may even be freshly allocated after that check, and find_dp() bounds j but not i. A crafted record thus overflows page_lcns[] of an otherwise valid entry. Add dp_range_ok() and reject, before each loop, any record whose run does not fit the entry. These are the only two page_lcns[] accesses indexed by the record rather than the entry, so together with the entry validation every access is now bounded. [almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89615

EUVD

EUVD-2026-76527

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's NTFS3 file system driver. It involves an out-of-bounds array access in the page_lcns[] index during processing of NTFS log records. A crafted NTFS record could cause the driver to write beyond the bounds of the page_lcns array, potentially leading to memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem implementation. Detection requires checking the kernel version and NTFS3 driver for affected configurations. Use commands like 'uname -a' to check kernel version and 'modinfo ntfs3' to inspect the NTFS3 module. If your system uses a vulnerable kernel version (likely 5.15+ with NTFS3 enabled), it may be affected.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service condition by crashing the system. In some cases, it might also enable privilege escalation or arbitrary code execution, depending on the kernel configuration and system state.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's NTFS3 filesystem driver. It does not directly relate to data privacy, access controls, or audit logging required by standards like GDPR or HIPAA. Compliance impact would depend on whether the affected system processes sensitive data, but the vulnerability itself is not a privacy or security control failure.

Mitigation Strategies

Immediately update the Linux kernel to the latest stable version that includes the fix for this NTFS3 vulnerability. Disable the NTFS3 filesystem module if not in use. Monitor vendor advisories for kernel patches. Restrict access to NTFS volumes from untrusted sources until patched.

Hi! I’m here to help you understand CVE-2026-89615. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70