CVE-2026-89615

Status: UPDATED  |  Advisory ID: CVE-2026-89615

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound page_lcns[] index by the log record

The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,

where i runs up to the log record's lcns_follow. That count is checked only

against the record's own length, not the target entry, so check_dp_table()

(which validates the entry's lcns_follow) does not cover it: the copy_lcns

entry may even be freshly allocated after that check, and find_dp() bounds j

but not i. A crafted record thus overflows page_lcns[] of an otherwise valid

entry.

Add dp_range_ok() and reject, before each loop, any record whose run does

not fit the entry. These are the only two page_lcns[] accesses indexed by

the record rather than the entry, so together with the entry validation

every access is now bounded.

[[email protected]: original patch contained changes to the problem already handled, applied partly] (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References