CVE-2026-89613: Linux Kernel NTFS Mapping Pairs Vulnerability

CVE-2026-89613 Overview

CVE-2026-89613 is a vulnerability in the Linux kernel's NTFS filesystem implementation. The flaw stems from improper validation of attributes containing empty mapping pairs when the highest Virtual Cluster Number (VCN) is inconsistent with the reported size. The upstream fix rejects such malformed attributes to prevent kernel-side corruption during NTFS metadata parsing.

The vulnerability affects Linux kernel builds that include the NTFS driver. Exploitation would rely on the kernel processing a crafted NTFS structure with inconsistent VCN and size fields.

Critical Impact
A crafted NTFS attribute with empty mapping pairs and inconsistent highest VCN and size values can trigger unsafe filesystem parsing behavior in the Linux kernel.

Affected Products

Linux kernel (NTFS filesystem driver)
Distributions shipping vulnerable kernel versions prior to the referenced stable patches
Systems mounting or processing untrusted NTFS volumes

Discovery Timeline

2026-09-11 - CVE-2026-89613 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89613

Vulnerability Analysis

The issue exists in the Linux kernel's NTFS filesystem code path that parses attribute records. NTFS attributes describe how file data maps to on-disk clusters through mapping pairs. Each non-resident attribute declares a highest VCN and an allocated size, and these fields must remain internally consistent.

When the kernel encounters an attribute with empty mapping pairs but a non-zero highest VCN or size, the resulting state is invalid. The pre-patch code failed to reject this condition, allowing malformed metadata to propagate through subsequent filesystem operations. The upstream fix explicitly rejects such attributes during parsing.

Root Cause

The root cause is missing input validation in the NTFS attribute parser [CWE-20]. The parser did not enforce the invariant that empty mapping pairs must correspond to a zero highest VCN and zero size. Without this check, attribute records with contradictory metadata are accepted, leading to unsafe downstream operations on filesystem structures.

Attack Vector

An attacker can craft a malformed NTFS image containing attributes with empty mapping pairs and inconsistent VCN or size fields. Triggering the vulnerability requires the kernel to mount or otherwise process the crafted NTFS volume. Scenarios include automounted USB media, disk images opened by privileged services, or network-accessible workflows that hand NTFS data to the kernel.

See the upstream fix commits for the specific validation logic: Kernel Patch 766062a and Kernel Patch b0cc6db.

// No verified exploit code is available for CVE-2026-89613.
// Refer to the upstream kernel commits for the corrective validation logic.

Detection Methods for CVE-2026-89613

Indicators of Compromise

Unexpected kernel warnings, oops messages, or panics referencing the NTFS driver during mount or attribute enumeration.
Repeated failed mount attempts against NTFS volumes from untrusted media.
Presence of unverified NTFS disk images in user-writable locations on servers processing removable media.

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for NTFS-related errors involving mapping pairs, VCN mismatches, or attribute parsing failures.
Audit systems for the running kernel version and compare against fixed stable releases referenced in the upstream commits.
Track processes and services that automount or scan removable NTFS media, and treat those code paths as high-risk.

Monitoring Recommendations

Forward kernel and audit logs to a centralized analytics platform for correlation across hosts.
Alert on mount operations sourced from removable media or user-controlled disk images.
Track file integrity of /boot and kernel package versions to confirm patch state across the fleet.

How to Mitigate CVE-2026-89613

Immediate Actions Required

Update the Linux kernel to a stable release that includes commits 766062a and b0cc6db.
Restrict mounting of NTFS volumes from untrusted sources, particularly USB and network-shared disk images.
Disable automount services on servers that do not require removable media support.
Audit privileged workflows that process user-supplied disk images and add validation or sandboxing.

Patch Information

The vulnerability is fixed in the upstream Linux kernel by two commits: Kernel Patch 766062a and Kernel Patch b0cc6db. Distribution vendors backport these fixes into their supported kernel branches. Apply vendor kernel updates and reboot affected hosts to activate the patched code.

Workarounds

Blacklist the ntfs kernel module on systems that do not require NTFS support using /etc/modprobe.d/.
Enforce mount policies via udev rules or systemd unit restrictions to block untrusted NTFS media.
Isolate systems that must process untrusted NTFS images inside virtual machines or containers with limited kernel exposure.

bash

# Example: prevent the vulnerable NTFS module from loading
echo 'blacklist ntfs' | sudo tee /etc/modprobe.d/disable-ntfs.conf
sudo update-initramfs -u
# Verify current kernel version against patched stable releases
uname -r