CVE-2026-89610: Linux Kernel NTFS Privilege Escalation

CVE-2026-89610 Overview

CVE-2026-89610 is an out-of-bounds access vulnerability in the Linux kernel NTFS (New Technology File System) driver. The flaw resides in the mapping pairs decoder, which validates the starting Logical Cluster Number (LCN) but fails to verify that a run extends within the volume boundary. A crafted NTFS image can trigger kernel memory access beyond the volume, leading to memory corruption and privilege escalation.

Critical Impact
A malformed NTFS image containing a crafted mapping pairs array can cause kernel memory corruption and potential privilege escalation when mounted or processed by a vulnerable Linux system.

Affected Products

Linux kernel versions containing the vulnerable NTFS mapping pairs decoder
Distributions shipping the affected NTFS driver without the upstream fix
Systems that mount or process untrusted NTFS filesystem images

Discovery Timeline

2026-09-11 - CVE-2026-89610 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89610

Vulnerability Analysis

The vulnerability affects the NTFS mapping pairs decoder in the Linux kernel. NTFS represents non-resident attribute data as a sequence of runs, each described by a length and an offset in the mapping pairs array. The decoder confirms that the starting LCN lies within the volume but does not confirm that lcn + length stays within nr_clusters.

An attacker who supplies a malformed NTFS image with a crafted mapping pairs array can define a run whose length extends past the end of the volume. When kernel code subsequently reads or writes clusters described by that run, it accesses memory outside the intended volume boundary. This leads to kernel memory corruption and can be leveraged for privilege escalation.

The upstream fix adds validation to ensure lcn + length remains within nr_clusters before the run is accepted.

Root Cause

The root cause is missing bounds validation on the combined offset and length of an NTFS run during mapping pairs decoding. The decoder trusted the length field encoded in the on-disk structure without cross-checking it against the total cluster count of the mounted volume.

Attack Vector

Exploitation requires the kernel to process an attacker-controlled NTFS image. Common paths include mounting a removable device, loop-mounting a file, or automounting user-supplied media. Once processed, the crafted mapping pairs array causes the decoder to compute run positions that extend beyond the volume, resulting in out-of-bounds kernel memory access.

No verified exploitation code is publicly available. Refer to the upstream kernel commits 6e844d4 and fea9e44 for the technical fix.

Detection Methods for CVE-2026-89610

Indicators of Compromise

Kernel oops, panic, or BUG: messages referencing NTFS functions during mount or file access operations
Unexpected mount attempts of NTFS images from removable media or user-writable paths
Kernel KASAN or slab-out-of-bounds reports involving the NTFS mapping pairs decoder

Detection Strategies

Audit kernel logs for NTFS-related crashes or memory corruption warnings that coincide with mount events
Track invocation of mount with the ntfs or ntfs3 filesystem type and correlate with the source image path and requesting user
Compare running kernel versions against distribution advisories that reference commits 6e844d4 and fea9e44

Monitoring Recommendations

Forward dmesg and journald kernel messages to a central log platform and alert on NTFS driver faults
Monitor for insertion of removable storage devices on servers and high-value workstations
Alert on loop device creation followed by mount of NTFS-formatted images by non-administrative users

How to Mitigate CVE-2026-89610

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 6e844d4 and fea9e44 as they land in distribution kernels
Restrict the ability of unprivileged users to mount NTFS filesystems on production systems
Disable automount of removable media on servers and shared workstations

Patch Information

The fix adds validation ensuring lcn + length stays within nr_clusters inside the mapping pairs decoder. Track distribution security trackers for backports of commits 6e844d4 and fea9e44 to supported stable kernel branches, and reboot after installing an updated kernel package.

Workarounds

Unload or blacklist the NTFS kernel module on systems that do not require NTFS support
Prevent unprivileged users from mounting filesystems by removing user and users options from /etc/fstab entries
Enforce policy on removable media using udev rules or mount managers to block NTFS auto-mounting

bash

# Blacklist the NTFS kernel modules until a patched kernel is installed
echo "blacklist ntfs"  | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
echo "blacklist ntfs3" | sudo tee -a /etc/modprobe.d/blacklist-ntfs.conf
sudo update-initramfs -u