CVE-2026-89616
Received Received - Intake

Linux kernel LZNT info-leak in NTFS3

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress_lznt()'s return value: unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem, frame_size); if ((ssize_t)unc_size < 0) err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL; decompress_lznt() stops as soon as the compressed stream is exhausted (e.g. a zero chunk header) and returns the number of bytes it actually wrote, which may be far less than frame_size. The bytes between unc_size and frame_size are never written. The only memset() that follows zeroes the region beyond i_valid; when the frame lies entirely within the file's valid size that memset() does not run, so the gap retains whatever was in the just-vmapped pages. All pages are then marked uptodate and returned to userspace, disclosing uninitialized (recently-freed) kernel page memory. A crafted compressed file whose stream decompresses to only a few bytes leaks the remainder of every frame on a plain read(2), which is enough to recover kernel pointers and defeat KASLR. Zero the [unc_size, frame_size) tail immediately after a successful LZNT decompress so the remainder reads back as zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89616
EUVD
EUVD-2026-76528

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where uninitialized memory is leaked during LZNT decompression in the NTFS3 filesystem. When decompressing a compressed file, the function may not fill the entire output buffer, leaving parts of it containing old kernel memory data. This allows attackers to read sensitive kernel information, potentially bypassing security measures like KASLR.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem driver and requires kernel memory inspection to detect. No standard network or system commands can directly identify this issue. Kernel memory forensics tools like crash or crash utility may help analyze vmapped pages for uninitialized memory exposure.

Impact Analysis

An attacker could exploit this to read uninitialized kernel memory, which may contain sensitive data like cryptographic keys, passwords, or other secrets. This could lead to further attacks, such as privilege escalation or bypassing security mechanisms. The impact depends on the system's configuration and the attacker's access level.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this NTFS3 LZNT decompression flaw. If immediate patching is not possible, disable the NTFS3 filesystem module (ntfs3) by blacklisting it or unmounting any NTFS3 volumes until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart