CVE-2026-89612: Linux Kernel NTFS Buffer Overflow Vulnerability

CVE-2026-89612 Overview

CVE-2026-89612 affects the Linux kernel's NTFS filesystem implementation. The parse_ntfs_boot_sector() function decoded the Master File Table (MFT) and MFTMirr Logical Cluster Numbers (LCNs) as signed 64-bit integers (s64), despite the NTFS on-disk format defining them as unsigned 64-bit values. A crafted boot sector containing a high-bit LCN value becomes negative after decoding and bypasses the existing upper-bound validation check. The invalid value then propagates into the MFT zone allocator, where it can trigger an out-of-bounds access against lcn_empty_bits_per_page. Mounting a malicious NTFS image is sufficient to reach the vulnerable code path.

Critical Impact
A malformed NTFS boot sector can trigger out-of-bounds memory access in the kernel, leading to potential denial of service or memory corruption.

Affected Products

Linux kernel (NTFS filesystem driver)
Distributions shipping vulnerable kernel versions prior to the referenced fix commits
Systems that permit mounting untrusted NTFS images (including removable media auto-mount configurations)

Discovery Timeline

2026-09-11 - CVE-2026-89612 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89612

Vulnerability Analysis

The NTFS boot sector defines the MFT and MFT mirror locations as unsigned 64-bit LCN fields. The Linux NTFS driver's parse_ntfs_boot_sector() routine assigned these fields into signed 64-bit (s64) variables. Any LCN value with the most significant bit set is reinterpreted as a large negative number when copied into the signed representation.

The existing sanity check compared the decoded LCN only against an upper bound derived from the volume size. A negative value trivially satisfies this comparison and is accepted as valid. The tainted LCN then flows into the MFT zone allocator, where it is used to compute an index into the per-page cluster bitmap tracked via lcn_empty_bits_per_page. The resulting offset falls outside the allocated bitmap region, producing an out-of-bounds memory access in kernel context.

Root Cause

The root cause is a signedness mismatch between the on-disk NTFS specification (unsigned 64-bit LCN) and the in-kernel decoding path (signed s64). Combined with a bounds check that did not enforce non-negativity, this input validation error allowed attacker-controlled cluster numbers to bypass validation.

Attack Vector

Exploitation requires the kernel to parse a crafted NTFS boot sector. Local attackers with the ability to attach removable media, or automated mount services that process untrusted images, provide realistic delivery paths. Environments that expose NTFS mounting to unprivileged users through udisks or similar helpers face additional exposure. The vulnerability does not require authentication once the image reaches the parser.

No public proof-of-concept exploit is currently available. Refer to the upstream fixes (Kernel Git Commit 8f8420b and Kernel Git Commit cc9d09f) for the exact validation logic added to reject negative LCNs.

Detection Methods for CVE-2026-89612

Indicators of Compromise

Kernel oops or panic messages referencing the NTFS driver, parse_ntfs_boot_sector, or lcn_empty_bits_per_page during mount operations.
Unexpected mount failures or system instability immediately following insertion of removable media containing NTFS filesystems.
Presence of unknown or unauthorized NTFS disk images on multi-user systems.

Detection Strategies

Monitor dmesg and journalctl -k output for NTFS parser errors, KASAN reports, or general protection faults tied to filesystem mount syscalls.
Audit mount events using auditd rules on the mount syscall to identify unexpected NTFS mount attempts by non-administrative users.
Track kernel version inventory against the fixed commit hashes to identify unpatched hosts across the fleet.

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on repeated NTFS parser faults from the same host.
Correlate removable media insertion events with subsequent kernel warnings to identify targeted mount-based attacks.
Baseline expected mount activity on servers and flag deviations, particularly on systems that should not process NTFS volumes.

How to Mitigate CVE-2026-89612

Immediate Actions Required

Apply the upstream kernel patches referenced in Kernel Git Commit 8f8420b and Kernel Git Commit cc9d09f as soon as distribution builds become available.
Restrict mounting of untrusted NTFS media by non-privileged users through polkit or udisks policy.
Disable automatic mounting of removable media on servers and workstations where it is not operationally required.

Patch Information

The fix adjusts parse_ntfs_boot_sector() to reject boot sectors whose MFT or MFTMirr LCN fields decode to negative values, preventing tainted cluster numbers from entering the MFT zone allocator. Track your distribution vendor's security advisories for backported builds that incorporate commits 8f8420b68a6f05ca2b03779d8208814ec539b9e5 and cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2.

Workarounds

Blacklist the ntfs kernel module on systems that do not require NTFS support until patched kernels are deployed.
Configure udev or desktop mount helpers to refuse automatic mounting of NTFS volumes from removable devices.
Limit physical access and USB port availability on high-value hosts to reduce the attack surface for malicious media.

bash

# Prevent automatic loading of the NTFS module until patched
echo "blacklist ntfs" | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
sudo depmod -a
sudo update-initramfs -u