Executive brief
The Linux kernel's NTFS3 filesystem driver contains an array bounds vulnerability in its journal log record processing. A crafted NTFS disk image or malicious journal record could cause the driver to write beyond allocated buffer boundaries, potentially leading to kernel memory corruption, system crash, or privilege escalation on systems that mount untrusted NTFS volumes.
Technical details
The vulnerability is an array index overflow (CWE-119/CWE-129) in fs/ntfs3/fslog.c within the NTFS journal replay logic. The copy_lcns loop and redo shorten loop index a page_lcns[] array using an index j+i, where i is controlled by the log record's lcns_follow field. This field is validated only against the record's own length by check_dp_table(), not against the target entry's lcns_follow capacity. A specially crafted log record can cause the index to exceed the allocated bounds of page_lcns[], resulting in out-of-bounds write. The vulnerability is reachable when mounting a crafted NTFS volume; no authentication or special privileges are required. The patch adds a dp_range_ok() validation function to ensure indices stay within bounds before processing each loop.
Affected products
- Linux Linux kernel multiple versions with NTFS3 support (fs/ntfs3 module)
Timeline
- 2026-09-11: disclosed: CVE-2026-89615 published on NVD
- 2026-07-24: patched: Upstream fix commit 6f7b9dbdc1b7520206abce0049bdd143eb536e75 authored
- 2026-09-07: other: Patch merged into stable kernel trees (e.g., linux-6.12.y)