Executive brief
The Linux kernel's NTFS filesystem driver contains a validation flaw in how it processes NTFS file attributes with empty mapping pairs. An attacker can craft a malicious NTFS filesystem that triggers memory corruption or denial of service when mounted, potentially crashing the system or allowing code execution.
Technical details
The vulnerability exists in the NTFS runlist handling code (fs/ntfs/runlist.c) in the ntfs_mapping_pairs_decompress() function. When processing NTFS file attributes, the code failed to properly validate the consistency of empty mapping pairs arrays against the attribute's metadata (highest VCN and size fields). An attacker can craft a malicious NTFS filesystem image with inconsistent attribute definitions that bypass validation checks, leading to out-of-bounds memory access or uninitialized data handling. The fix adds explicit validation to reject attributes with empty mapping pairs that have inconsistent highest VCN or allocated/data/initialized size values. This vulnerability affects any system that mounts untrusted NTFS filesystems, and no user interaction is required beyond filesystem mounting.
Affected products
- Linux Linux kernel All versions prior to patch (commit 766062a82e1ce4087c7dc077224144dfd34b3661)
Timeline
- 2026-09-11: disclosed: CVE-2026-89613 published
- 2026-08-20: patched: Fix committed upstream (commit 766062a82e1ce4087c7dc077224144dfd34b3661)