CVE-2026-89617: Linux Kernel NTFS3 Buffer Overflow Vulnerability

CVE-2026-89617 is a buffer overflow flaw in Linux kernel NTFS3 filesystem that occurs during log replay validation. Attackers can exploit crafted page table entries to trigger out-of-bounds access. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-89617 Overview

CVE-2026-89617 is an out-of-bounds access vulnerability in the Linux kernel fs/ntfs3 filesystem driver. The flaw exists in the log replay code path that processes DIR_PAGE_ENTRY records during NTFS journal recovery. Each entry ends in a variable-length page_lcns[] array whose size is declared by the on-disk lcns_follow field. The check_rstbl() function validates general table bookkeeping but never verifies that this array fits within the entry, allowing a crafted lcns_follow value to steer subsequent memmove and replay operations beyond the entry buffer. Successful exploitation can corrupt kernel memory when a specially crafted NTFS volume is mounted or replayed.

Critical Impact
A local attacker able to supply a malicious NTFS image can trigger memory corruption in kernel space, leading to privilege escalation, information disclosure, or system crash.

Affected Products

Linux kernel fs/ntfs3 driver (upstream, prior to the fix)
Stable kernel branches referenced by patches 006cb77, 0908da0, 0e07ea2, 1200c27, 1e90b17, 2d94ffc, and d231556
Distributions shipping the ntfs3 driver without the backported fixes

Discovery Timeline

2026-09-11 - CVE-2026-89617 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89617

Vulnerability Analysis

The ntfs3 driver replays the NTFS logfile to bring the filesystem to a consistent state after mount. During replay, the driver walks a restart table containing DIR_PAGE_ENTRY structures. Each such entry terminates in a flexible array member page_lcns[], and the number of valid elements is stored on disk in the lcns_follow field of the entry header.

The existing validator, check_rstbl(), checks record counts and offsets but treats lcns_follow as trusted input. It never confirms that struct_size(entry, page_lcns, lcns_follow) fits within the entry's allocated size. When the driver later performs a v0-to-v1 layout conversion, it issues a memmove sized from lcns_follow. It also indexes page_lcns[] from find_dp() (used by the HotFix store) and from self-bounded scan loops. Every one of these consumers assumes lcns_follow reflects real capacity.

Root Cause

The root cause is missing input validation [CWE-20] of an attacker-controlled length field describing a variable-length array embedded in an on-disk structure. Because lcns_follow is not bounded against the entry size, a crafted value produces an out-of-bounds read or write during replay processing.

Attack Vector

Exploitation requires local access and the ability to introduce a crafted NTFS image that the kernel mounts or replays. Typical triggers include a malicious USB drive, a user-supplied disk image mounted via a privileged loopback path, or automated media mount services. No user interaction beyond media insertion is required in environments that auto-mount removable filesystems. The upstream fix adds check_dp_table() immediately after check_rstbl() to reject any entry larger than its declared size, using the same struct_size() expression used at allocation time so the check is overflow-safe by construction. See the kernel patch series for the exact validator implementation.

Detection Methods for CVE-2026-89617

Indicators of Compromise

Kernel oops or panic messages referencing ntfs3, check_rstbl, find_dp, or log replay during mount of an NTFS volume
Unexpected dmesg entries showing slab corruption, KASAN out-of-bounds reports, or BUG: traces inside the ntfs3 code path
Mount events for untrusted removable media immediately preceding system instability

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds accesses in page_lcns[] handling during replay
Alert on kernel ring buffer messages containing ntfs3 alongside oops, WARN, or BUG signatures
Correlate USB or block device insertion events with subsequent kernel faults on endpoints processing untrusted media

Monitoring Recommendations

Ship kernel logs and audit events to a central analytics platform and search for ntfs3 fault signatures
Track mount syscalls for filesystem type ntfs3 originating from non-administrative sessions
Monitor for privilege escalation attempts or unexpected process launches shortly after NTFS mounts on multi-user systems

How to Mitigate CVE-2026-89617

Immediate Actions Required

Apply the stable-tree ntfs3 patches introducing check_dp_table() to all affected kernel builds
Restrict mounting of untrusted NTFS volumes to administrator-only workflows until patched kernels are deployed
Disable automatic mounting of removable media on servers and shared workstations

Patch Information

The fix adds check_dp_table() after check_rstbl() to reject any DIR_PAGE_ENTRY whose declared lcns_follow exceeds the entry's actual size, using struct_size() for an overflow-safe bound. Backports are available across stable branches via commits 006cb77, 0908da0, 0e07ea2, 1200c27, 1e90b17, 2d94ffc, and d231556. Consult your distribution's security tracker for the corresponding kernel package version and apply vendor-provided updates.

Workarounds

Blacklist the ntfs3 kernel module on systems that do not require NTFS support
Enforce udev or polkit policies that prevent non-root users from mounting NTFS filesystems
Use userspace NTFS handlers such as ntfs-3g under FUSE where kernel-level ntfs3 is not required

bash

# Prevent loading of the vulnerable driver until patched
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo depmod -a
# Verify the module is not loaded
lsmod | grep ntfs3