CVE-2026-89616: Linux Kernel NTFS3 Information Disclosure

CVE-2026-89616 Overview

CVE-2026-89616 is an information disclosure vulnerability in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in ni_read_frame(), which decompresses LZNT $DATA frames into vmapped target pages. When decompress_lznt() writes fewer bytes than the frame size (for example, when the compressed stream ends early due to a zero chunk header), the untouched tail region is never zeroed. The pages are then marked uptodate and returned to userspace, disclosing uninitialized kernel page memory that may contain recently freed data.

Critical Impact
A crafted NTFS-compressed file can leak kernel memory contents through a simple read(2) call, exposing kernel pointers and enabling KASLR bypass.

Affected Products

Linux kernel fs/ntfs3 filesystem driver
Multiple stable kernel branches (see kernel.org commits 0f699dd, 35d1ea9, 376ee45, 4a1b39b, 77d8efd, 7d60a4c, cd40eee)
Any distribution shipping the ntfs3 driver prior to the fix

Discovery Timeline

2026-09-11 - CVE-2026-89616 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89616

Vulnerability Analysis

The vulnerability is an uninitialized memory disclosure in the NTFS3 driver's compressed-file read path. ni_read_frame() calls decompress_lznt() to expand an on-disk LZNT chunk into a set of vmapped destination pages sized at frame_size. The function trusts the returned unc_size for error checking but assumes the full frame region was written.

In practice, decompress_lznt() stops as soon as the compressed stream is exhausted. A zero chunk header, for example, terminates decompression immediately. The bytes between unc_size and frame_size remain untouched. The subsequent memset() in the function only zeroes the region beyond the inode's valid size (i_valid). When the frame lies fully within the file's valid size, that memset() is skipped entirely.

The destination pages are then flagged uptodate and served to the calling process. The gap contains whatever data the just-vmapped pages held, typically recently freed kernel page contents. This leaks kernel pointers usable to defeat Kernel Address Space Layout Randomization (KASLR).

Root Cause

The root cause is a missing zero-initialization of the destination buffer tail after a partial decompression. ni_read_frame() conflates "decompression succeeded" with "entire frame buffer written," but LZNT streams can legally terminate before filling the frame. This is a classic uninitialized memory use pattern, related to [CWE-908] Use of Uninitialized Resource and [CWE-200] Exposure of Sensitive Information.

Attack Vector

Exploitation requires a local unprivileged user to read a maliciously crafted NTFS filesystem containing a compressed $DATA attribute whose LZNT stream decompresses to only a few bytes per frame. Any read of that file returns the uninitialized tail of each frame. Attack scenarios include:

Automounting of attacker-supplied USB drives or disk images
Multi-tenant systems where users can mount NTFS images
Sandboxed workloads that process user-supplied NTFS containers

Although the CVSS vector lists AV:N, practical exploitation is filesystem-local. The fix zeroes the [unc_size, frame_size) tail immediately after a successful LZNT decompress, ensuring the remainder reads back as zero.

No public proof-of-concept is currently listed. Refer to the upstream kernel commits for the exact patch diff.

Detection Methods for CVE-2026-89616

Indicators of Compromise

Mount events for untrusted NTFS volumes originating from removable media or user-supplied images
Processes reading compressed NTFS $DATA streams from newly mounted volumes
Kernel version strings matching pre-patch releases with the ntfs3 driver enabled (CONFIG_NTFS3_FS=y)

Detection Strategies

Inventory Linux hosts and identify kernels shipping vulnerable fs/ntfs3 code; compare against the fix commits 0f699dd, 35d1ea9, and cd40eee.
Audit dmesg and auditd records for mount -t ntfs3 operations on non-administrative paths.
Enable syscall auditing for mount() and read() on filesystems typed as ntfs3 to correlate suspicious activity.

Monitoring Recommendations

Alert on unprivileged users triggering mounts of NTFS images or loop devices.
Log filesystem type transitions and unusual read patterns against attacker-writable mount points.
Track kernel patch levels through configuration management to flag hosts running unfixed ntfs3 code.

How to Mitigate CVE-2026-89616

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 376ee45, 4a1b39b, 77d8efd, and 7d60a4c once shipped by your distribution.
Disable automatic mounting of removable NTFS media on multi-user and shared systems.
Restrict mount privileges so unprivileged users cannot mount arbitrary NTFS images.

Patch Information

The fix zeroes the [unc_size, frame_size) region of the frame buffer immediately after a successful decompress_lznt() call in fs/ntfs3/frecord.c. Consult the Kernel Git Commit 0f699dd and companion stable-tree commits for backport availability. Update to the earliest distribution kernel that incorporates one of the referenced fix commits.

Workarounds

Unload or blacklist the ntfs3 kernel module where NTFS support is not required (modprobe -r ntfs3; add blacklist ntfs3 to /etc/modprobe.d/).
Prefer ntfs-3g (FUSE) for handling untrusted NTFS media until the kernel patch is deployed.
Enforce noexec,nosuid,nodev mount options and confine mount operations to administrator-controlled paths.

bash

# Configuration example: prevent loading of the vulnerable ntfs3 module
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/disable-ntfs3.conf
sudo modprobe -r ntfs3 2>/dev/null || true

# Verify current kernel version against patched builds
uname -r