CVE-2026-89611: Linux Kernel NTFS Buffer Overflow Vulnerability

CVE-2026-89611 Overview

CVE-2026-89611 is a memory corruption vulnerability in the Linux kernel's NTFS filesystem driver. The flaw resides in ntfs_attr_update_meta(), which shifts attribute names when converting between non-sparse and sparse attributes. The function fails to validate name_offset boundaries or verify that sufficient space exists for the additional compressed_size field. A malicious Master File Table (MFT) record can trigger out-of-bounds writes beyond the attribute record or corrupt mapping pairs during conversion. Exploitation requires mounting or parsing a crafted NTFS filesystem, which can lead to kernel memory corruption.

Critical Impact
An attacker supplying a crafted NTFS image can trigger kernel-space out-of-bounds writes, resulting in memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel (NTFS filesystem driver)
Distributions shipping vulnerable kernel versions prior to the referenced fix commits
Systems mounting untrusted NTFS volumes or images

Discovery Timeline

2026-09-11 - CVE-2026-89611 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89611

Vulnerability Analysis

The vulnerability originates in the NTFS attribute validation logic within the Linux kernel. The function ntfs_attr_update_meta() performs in-place transformation of NTFS attributes when transitioning between non-sparse and sparse representations. During conversion to a sparse attribute, the routine inserts a compressed_size field ahead of the attribute name and mapping pairs, then shifts the name forward by eight bytes to preserve layout.

The validator does not confirm that name_offset falls within safe bounds relative to the attribute record. It also does not confirm that eight additional bytes are available after mapping_pairs_offset for the newly introduced compressed_size field. This is a classic out-of-bounds write [CWE-787] driven by insufficient input validation of on-disk metadata.

Root Cause

The root cause is missing bounds checking on attacker-controlled offsets in NTFS attribute records. Specifically, name_offset values are not validated against the attribute record length, and no verification ensures the name range does not overlap with the mapping pairs region. Non-sparse, non-compressed attributes also lack a check confirming that eight bytes are free after mapping_pairs_offset.

Attack Vector

An attacker crafts an NTFS MFT record positioning the attribute name at the extreme tail of a non-sparse attribute. When the kernel converts the attribute to sparse form, the eight-byte forward shift writes past the attribute boundary. Alternatively, overlapping the name with mapping pairs corrupts filesystem metadata during conversion. Delivery vectors include mounting malicious USB drives, disk images, or network-attached NTFS volumes.

No verified public exploit code is available. See the upstream fix in Linux Kernel Commit a83e82b and Linux Kernel Commit cd7b3dc for technical details.

Detection Methods for CVE-2026-89611

Indicators of Compromise

Unexpected kernel oops or BUG: messages referencing ntfs_attr_update_meta or adjacent NTFS functions in dmesg.
Filesystem corruption warnings emitted when mounting or accessing NTFS volumes from untrusted sources.
Sudden kernel panics or slab corruption reports following insertion of removable NTFS media.

Detection Strategies

Monitor kernel logs for NTFS-related faults, out-of-bounds access reports from KASAN, or slab corruption signatures.
Audit mount events for NTFS filesystems originating from removable media, network shares, or user-supplied images.
Track kernel version inventory across the fleet to identify hosts running builds that predate the referenced fix commits.

Monitoring Recommendations

Forward auditd mount events and kernel log messages to a centralized logging pipeline for correlation.
Alert on repeated NTFS mount failures or kernel warnings from endpoints that do not routinely process NTFS media.
Baseline expected NTFS mount activity per host role so anomalous mounts stand out for review.

How to Mitigate CVE-2026-89611

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits and reboot affected systems.
Restrict mounting of NTFS filesystems from untrusted sources until patched kernels are deployed.
Disable automatic mounting of removable media on servers and multi-user endpoints.

Patch Information

Upstream fixes are available in the Linux kernel stable tree. See Linux Kernel Commit a83e82b and Linux Kernel Commit cd7b3dc. The patches add validation for name_offset bounds, confirm the name range does not overlap mapping pairs, and verify eight bytes are available after mapping_pairs_offset for the compressed_size field. Rebuild or update the kernel package from your distribution once the fix is backported.

Workarounds

Blacklist the ntfs kernel module on systems that do not require NTFS support using modprobe configuration.
Enforce noauto and access controls on /etc/fstab entries for NTFS volumes to prevent unattended mounting.
Use udev rules to block automatic mounting of removable storage on servers pending patch deployment.

bash

# Blacklist the NTFS kernel module until patches are applied
echo "blacklist ntfs" | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
sudo update-initramfs -u

# Verify installed kernel version
uname -r