CVE-2026-89614: Linux Kernel NTFS Use-After-Free Vulnerability

CVE-2026-89614 Overview

CVE-2026-89614 is an out-of-bounds read vulnerability in the Linux kernel's NTFS file system driver. The flaw resides in ntfs_cluster_alloc(), which bounds its scan of the free-cluster bitmap by the on-disk $Bitmap size rather than by the volume's cluster count. A crafted NTFS image whose $Bitmap covers more clusters than the volume itself allows the scan index to reach past the vol->lcn_empty_bits_per_page array. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. The Linux kernel maintainers resolved the issue by clamping the scan to the array bounds and rejecting decoded LCNs at or beyond nr_clusters.

Critical Impact
Mounting or extending files on a malicious NTFS image can trigger a slab out-of-bounds read in the kernel, leading to memory disclosure, kernel instability, or potential exploitation for privilege escalation.

Affected Products

Linux kernel NTFS file system driver (mainline kernel prior to fix commits)
Linux distributions shipping vulnerable kernel versions with NTFS support enabled
Systems permitting mount of untrusted NTFS images

Discovery Timeline

2026-09-11 - CVE-2026-89614 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89614

Vulnerability Analysis

The vulnerability affects the NTFS free-cluster allocator in the Linux kernel. At mount time, vol->lcn_empty_bits_per_page is sized from vol->nr_clusters, the actual volume cluster count. However, ntfs_cluster_alloc() bounds its scan of that array using the size of the $Bitmap file. These are independent on-disk quantities, and the mount-time validation only rejects a $Bitmap that is too small.

When an attacker-crafted image presents a $Bitmap covering more clusters than the volume actually has, the allocator can index past the allocated array. Because the caller passes the file's own last logical cluster number (LCN) as a locality hint, a run whose LCN lies in that gap directs the allocator straight to the out-of-bounds region. KASAN flags this as a slab out-of-bounds read when the file is extended.

Root Cause

The root cause is inconsistent bounds enforcement between two independent on-disk quantities: $Bitmap size and nr_clusters. The mount-time check only guards against a $Bitmap that is too small, leaving the too-large case unhandled. The mapping pairs decoder likewise accepted decoded LCNs at or beyond nr_clusters without validation.

Attack Vector

Exploitation requires an attacker to supply a crafted NTFS image that a target system mounts and interacts with. Local attackers can trigger the flaw by inserting removable media or convincing a privileged process to mount a malicious image. Automount daemons and container runtimes that process untrusted disk images expand the attack surface. Extending any file on the malicious volume drives the allocator into the out-of-bounds region.

No public proof-of-concept exploit is currently referenced in the NVD entry, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Kernel Git Commit 19cac79 and Kernel Git Commit dc15a9f for the upstream fixes.

Detection Methods for CVE-2026-89614

Indicators of Compromise

KASAN slab-out-of-bounds read reports referencing ntfs_cluster_alloc in kernel logs (dmesg, journalctl -k).
Unexpected kernel oops, panic, or NTFS driver errors following mounts of removable media or disk images.
Mount events for NTFS images originating from untrusted sources such as downloaded ISOs, email attachments, or USB devices.

Detection Strategies

Enable KASAN in test and canary kernels to surface out-of-bounds reads during file extension operations on NTFS volumes.
Monitor syslog and audit logs for NTFS driver warnings, mapping pair decode errors, or messages referencing lcn_empty_bits_per_page.
Correlate mount events for untrusted file systems with subsequent kernel warnings using centralized log aggregation.

Monitoring Recommendations

Track kernel version deployment across the fleet to identify hosts still running vulnerable NTFS driver code.
Alert on mount operations of NTFS file systems on servers and workloads where NTFS is not expected.
Ingest kernel telemetry into a centralized data lake for retrospective hunting on NTFS-related crash signatures.

How to Mitigate CVE-2026-89614

Immediate Actions Required

Apply the upstream kernel patches referenced in Kernel Git Commit 19cac79 and Kernel Git Commit dc15a9f once packaged by your distribution.
Restrict who can mount removable media and disk images on multi-user systems, particularly servers and shared workstations.
Disable automount of NTFS images on systems that do not require it.

Patch Information

The fix clamps the free-cluster bitmap scan to what vol->lcn_empty_bits_per_page actually covers, mirroring the max_index calculation used by the mount-time scan. The mapping pairs decoder additionally rejects any decoded LCN at or beyond nr_clusters. Conforming NTFS volumes are unaffected by the change. Consult your Linux distribution's security advisory channel for backported kernel packages.

Workarounds

Blacklist the ntfs and ntfs3 kernel modules on hosts that do not require NTFS support using /etc/modprobe.d/ rules.
Enforce mount policies that prohibit mounting NTFS volumes from untrusted sources or unprivileged users.
Isolate workloads that must process untrusted NTFS images in ephemeral virtual machines or sandboxed containers.

bash

# Disable the NTFS kernel modules until patched packages are deployed
echo "install ntfs /bin/false" | sudo tee /etc/modprobe.d/disable-ntfs.conf
echo "install ntfs3 /bin/false" | sudo tee -a /etc/modprobe.d/disable-ntfs.conf
sudo update-initramfs -u