CVE-2026-89781

Status: UPDATED  |  Advisory ID: CVE-2026-89781

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

read_log_rec_buf() copies a log record into a caller buffer starting at

u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;

log->record_header_len (and log->data_off, used for the following pages)

comes verbatim from the on-disk restart area and is only checked for

8-byte alignment in is_rst_area_valid(), so off can exceed

log->page_size. "tail = log->page_size - off" then underflows and

memcpy() reads past the page_size-sized buffer returned by

read_log_page(), spilling adjacent slab memory into the replay buffer.

This is reachable by mounting a crafted NTFS image:

BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580

Read of size 64 at addr ffff88800a877ff8 by task exploit/127

read_log_rec_buf fs/ntfs3/fslog.c:2299

log_replay fs/ntfs3/fslog.c:4216

ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324

ntfs_fill_super fs/ntfs3/super.c:1392

get_tree_bdev_flags fs/super.c:1694

__x64_sys_mount fs/namespace.c:4360

The buggy address is located 4088 bytes to the right of

the 4096-byte region [ffff88800a876000, ffff88800a877000)

Reject an in-page offset outside the current page before the copy.

[[email protected]: replaced the >= sign with >] (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References