CVE-2026-89615: Linux Kernel NTFS3 Buffer Overflow Vulnerability

CVE-2026-89615 Overview

CVE-2026-89615 is an out-of-bounds access vulnerability in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in the NTFS log-replay code path, where the copy_lcns loop and the redo shorten loop index page_lcns[] at j + i. The upper bound i derives from the log record's lcns_follow field rather than the target entry, allowing a crafted log record to overflow page_lcns[] of an otherwise valid entry. A local attacker able to mount or process a malicious NTFS image can trigger memory corruption in kernel space.

Critical Impact
A crafted NTFS log record can overflow page_lcns[] in kernel memory, enabling local attackers to compromise confidentiality, integrity, and availability of the affected system.

Affected Products

Linux kernel fs/ntfs3 filesystem driver
Kernel branches receiving fixes via commits 1135ebc, 31fdd11f, 61ca8cb, 6f7b9db, 7ccb949, bb742d1, and f4c1bc6
Distributions shipping vulnerable ntfs3 versions prior to the referenced stable backports

Discovery Timeline

2026-09-11 - CVE-2026-89615 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89615

Vulnerability Analysis

The vulnerability lives in the NTFS journal replay logic of the ntfs3 driver. During log replay, the kernel processes dirty page (dp) table entries that describe which logical cluster numbers (LCNs) belong to a modified page. The copy_lcns loop and the redo shorten loop both index into the page_lcns[] array at position j + i, where i iterates up to lcns_follow taken from the current log record.

The check_dp_table() routine validates lcns_follow for the target dp entry, but it does not validate the count carried by the log record itself. Additionally, find_dp() bounds only the base index j and not the per-record iterator i. As a result, an attacker-supplied record can advertise an lcns_follow value larger than the target entry accommodates, producing an out-of-bounds write into adjacent kernel memory.

Root Cause

The root cause is a missing bounds check between two related but independent metadata sources. The log record's lcns_follow value is trusted for loop iteration without correlating it against the destination dp entry's actual capacity. This is a classic Out-of-Bounds Write pattern arising from asymmetric validation between input structures.

Attack Vector

Exploitation requires local access with the ability to trigger NTFS log replay, typically by mounting a crafted NTFS volume or presenting a malicious block device to the kernel. Because the flaw executes inside kernel context, successful exploitation can corrupt kernel data structures, escalate privileges, or crash the host. No user interaction beyond mount handling is required.

The upstream fix introduces a dp_range_ok() helper that rejects any record whose run does not fit the target entry before the two vulnerable loops execute. See the patch series referenced under Kernel Git Commit 7ccb949 for the authoritative implementation.

Detection Methods for CVE-2026-89615

Indicators of Compromise

Kernel oops or panic traces referencing ntfs3, copy_lcns, find_dp, or check_dp_table in dmesg or journalctl -k output.
Unexpected mount attempts of NTFS volumes from removable media or untrusted images on servers that do not normally handle NTFS.
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds writes near page_lcns[] allocations.

Detection Strategies

Audit kernel version inventory across Linux endpoints and servers to identify hosts running vulnerable ntfs3 builds prior to the stable patch backports.
Monitor mount syscall telemetry for NTFS filesystem types (-t ntfs3) originating from non-administrative users or automated media handlers.
Correlate kernel crash reports with recent NTFS mount events to surface exploitation attempts.

Monitoring Recommendations

Ship kernel logs to a centralized analytics platform and alert on ntfs3 fault signatures.
Track loadable kernel module usage of ntfs3 on production systems where NTFS is not required.
Baseline external device insertion events on shared workstations to detect anomalous NTFS mounts.

How to Mitigate CVE-2026-89615

Immediate Actions Required

Apply the vendor-supplied kernel updates that incorporate the dp_range_ok() bounds check as soon as they are available for your distribution.
Disable automatic mounting of removable media on servers and multi-user systems that do not require NTFS support.
Blocklist the ntfs3 kernel module on hosts that have no operational need to read NTFS volumes.

Patch Information

The upstream fix is distributed across the following stable branch commits: Kernel Git Commit 1135ebc, Kernel Git Commit 31fdd11f, Kernel Git Commit 61ca8cb, Kernel Git Commit 6f7b9db, Kernel Git Commit 7ccb949, Kernel Git Commit bb742d1, and Kernel Git Commit f4c1bc6. Rebuild or update kernels to include the corresponding backport for your branch.

Workarounds

Prevent unprivileged users from mounting filesystems by ensuring user, users, and nofail options are not present in /etc/fstab entries for NTFS media.
Use modprobe blacklisting to prevent the ntfs3 module from loading where it is not needed.
Restrict physical and virtual access to block devices, since exploitation requires the kernel to process a crafted NTFS image.

bash

# Blacklist the ntfs3 kernel module until patched kernels are deployed
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep ntfs3