Executive brief
The Linux kernel's NTFS3 file system driver contains a flaw in log record processing that can leak sensitive kernel memory. When mounting a specially crafted NTFS image, an attacker can trigger an out-of-bounds memory read that exposes data from adjacent kernel memory, potentially compromising system confidentiality and leading to further exploitation.
Technical details
The vulnerability is a classic out-of-bounds read in the read_log_rec_buf() function within fs/ntfs3/fslog.c. The root cause is insufficient validation of the record_header_len field parsed from an untrusted on-disk NTFS restart area. This field is only checked for 8-byte alignment but not for whether it causes the calculated offset (off) to exceed the log page buffer size. When off exceeds page_size, the subsequent calculation "tail = log->page_size - off" causes integer underflow, resulting in a memcpy() that reads past the page_size-sized buffer, leaking adjacent slab memory. Exploitation requires a local attacker with the ability to mount a crafted NTFS image. The fix validates that off does not exceed log->page_size before performing the copy, rejecting invalid images with -EINVAL.
Affected products
- Linux Linux Kernel 5.x through 6.x (multiple stable branches affected)
Timeline
- 2026-09-16: disclosed: CVE-2026-89781 published
- 2026-09-14: patched: Fix merged into stable Linux kernel trees