Executive brief
The Linux kernel's NTFS3 filesystem driver contains a validation flaw in extended attribute (EA) record processing that can leak sensitive kernel memory to unprivileged user processes. When a crafted NTFS disk image contains malformed EA records with inconsistent size fields, the kernel incorrectly copies data beyond allocated buffer boundaries and exposes heap contents via the getxattr() system call. An attacker with access to a malicious disk image could extract kernel memory secrets without requiring elevated privileges.
Technical details
The vulnerability is a heap buffer over-read in fs/ntfs3/xattr.c affecting EA record validation. The ntfs_read_ea() function checks that an EA record fits within the remaining buffer (ea_size > bytes) but fails to validate that the ef->size field is large enough to cover the record's actual name and value data. An attacker can craft an NTFS image with ef->size=24 but elength=0xffff; ntfs_get_ea() then trusts the oversized elength field and performs a memcpy() that reads up to 65535 bytes from a 84-byte allocation, leaking heap memory. The vulnerability requires read access to a malicious NTFS filesystem (local attack) and can be triggered via getxattr() without special privileges. A patch adds validation to compute the required record size and reject ef->size values that do not cover the full name and value.
Affected products
- Linux Linux kernel multiple versions (see kernel.org stable branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89779 published on NVD
- 2026-06-24: patched: Upstream fix committed by Weiming Shi
- 2026-09-14: advisory: Stable kernel releases patched by Greg Kroah-Hartman