Executive brief
The Linux kernel's NTFS3 filesystem driver contains a vulnerability in its handling of NTFS transaction log replay. When mounting a specially crafted NTFS image, an attacker can trigger an out-of-bounds memory write by supplying an artificially large transaction ID. This can lead to memory corruption, kernel crashes, or potential code execution on systems that mount untrusted NTFS volumes.
Technical details
The vulnerability exists in the NTFS3 filesystem's log replay code (fs/ntfs3/fslog.c), where the alloc_rsttbl_from_idx() function grows a restart table to accommodate a transaction ID without properly validating the magnitude of that ID. The root cause is a type truncation: the table entry count is computed as a u32 but stored in a struct field as __le16 (16-bit unsigned little-endian). When the computed count exceeds U16_MAX (65,535), it silently truncates, causing the kernel to allocate a much smaller table than required. Subsequent code then writes to the original, untruncated offset, resulting in an out-of-bounds heap write. The vulnerability is reachable by mounting a crafted NTFS image without requiring elevated privileges or authentication. The fix is to validate and reject restart table growth requests that exceed U16_MAX entries in the extend_rsttbl() function.
Affected products
- Linux Linux kernel affected versions prior to CVE-2026-89782 fix
Timeline
- 2026-09-16: disclosed: CVE-2026-89782 advisory published
- patched: Patch available to reject restart table growth beyond U16_MAX entries