Executive brief
The Linux kernel's NTFS3 filesystem driver failed to validate that directory page entries fit within their allocated bounds during journal log replay. A crafted NTFS filesystem could trigger out-of-bounds memory access during recovery, potentially leading to privilege escalation or denial of service on systems mounting such malicious volumes.
Technical details
The vulnerability is a bounds-checking flaw in the NTFS3 filesystem driver's journal log replay logic. The DIR_PAGE_ENTRY structure contains a variable-length page_lcns[] array whose size is specified by the on-disk lcns_follow field. The check_rstbl() function validated table bookkeeping but did not verify that the array actually fits within the allocated entry, allowing a crafted lcns_follow value to cause the v0→v1 conversion memmove and subsequent replay passes to read or write past the entry boundaries. The fix adds check_dp_table() to validate that each entry's declared size does not exceed the allocated buffer. Attack requires local filesystem mounting privilege and a specially crafted NTFS image; the flaw is triggered during journal replay on mount.
Affected products
- Linux Linux kernel 5.10 through 6.18 and later (NTFS3 filesystem driver)
Timeline
- 2026-09-11: disclosed: CVE-2026-89617 published
- 2026-07-29: patched: Fix committed upstream by Konstantin Komarov
- 2026-09-07: patched: Backported to stable Linux trees