CVE-2026-89779: Linux Kernel NTFS3 Information Disclosure

CVE-2026-89779 Overview

CVE-2026-89779 is an out-of-bounds read vulnerability in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in ntfs_read_ea(), which fails to validate that an extended attribute (EA) record's ef->size field covers the record's name_len + 1 + elength. A crafted NTFS image can pass the existing size check while declaring an oversized elength value. When ntfs_get_ea() later copies the value using the attacker-controlled length, it reads past the kmalloc() allocation and leaks adjacent kernel heap memory to userspace through getxattr().

Critical Impact
A crafted NTFS filesystem image can trigger a slab-out-of-bounds read of up to 65,535 bytes, leaking kernel heap contents to userspace and enabling potential kernel memory disclosure.

Affected Products

Linux kernel fs/ntfs3 driver (multiple stable branches)
Distributions shipping the ntfs3 in-tree filesystem driver
Systems allowing mount or automount of untrusted NTFS images

Discovery Timeline

2026-09-16 - CVE-2026-89779 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89779

Vulnerability Analysis

The vulnerability affects the ntfs3 kernel driver's handling of NTFS extended attribute (EA) records. Each EA record contains fields describing its total size, its attribute name_len, and the value length elength. ntfs_read_ea() verifies that the record fits within the remaining EA buffer using an ea_size > bytes comparison, but it does not verify that ef->size is itself large enough to contain the record's declared name and value.

As a result, a crafted image can present a small ef->size such as 24 bytes while advertising elength = 0xffff. ntfs_get_ea() trusts elength and issues a memcpy() of up to 65,535 bytes from a kmalloc(info->size) allocation. KASAN reports the read as slab-out-of-bounds inside kmalloc-96, with the buggy address 80 bytes into an 84-byte region.

Root Cause

The root cause is missing bounds validation between related length fields in on-disk metadata. The driver enforces outer-buffer containment but never asserts the internal invariant ef->size >= sizeof(*ef) + name_len + 1 + elength. This is a classic input validation error [CWE-125] where untrusted filesystem metadata is treated as authoritative without cross-field consistency checks.

Attack Vector

Exploitation requires the target to mount or otherwise process an attacker-supplied NTFS image via the ntfs3 driver. On systems where non-privileged users can trigger automounting of removable media, or where NTFS images are mounted from untrusted network sources, an attacker can craft an image that produces heap disclosure via getxattr(). Leaked kernel heap contents may include pointers, credentials, or other sensitive structures useful for bypassing KASLR or chaining subsequent exploits.

No public proof-of-concept exploit has been published beyond the KASAN reproduction embedded in the upstream commit messages. See the Linux Kernel Commit c22f91d for the fix and technical details.

Detection Methods for CVE-2026-89779

Indicators of Compromise

Unexpected getxattr() or listxattr() syscalls issued against files on freshly mounted NTFS volumes
KASAN or kernel oops entries referencing ntfs_get_ea or ntfs_read_ea in dmesg
Mount events for NTFS images originating from removable media, ISO files, or user-writable paths

Detection Strategies

Audit kernel logs for slab-out-of-bounds reports in the ntfs3 module and correlate with the invoking process and mount source
Monitor mount and automount activity for NTFS filesystems from non-standard or user-controlled locations
Enable kernel auditd rules on the mount syscall with filesystem type filters for ntfs3

Monitoring Recommendations

Ingest kernel telemetry, auditd, and syslog into a centralized analytics pipeline to correlate mount events with subsequent xattr access
Alert on user processes performing getxattr() against files on removable NTFS media shortly after mount
Track kernel version and ntfs3 patch status across the fleet to prioritize unpatched hosts

How to Mitigate CVE-2026-89779

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems
Restrict mounting of NTFS filesystems to trusted administrators and disable user-triggered automount for removable media where feasible
Inventory hosts running the ntfs3 driver and prioritize patching on multi-user or kiosk systems

Patch Information

The fix computes the required record size and requires ef->size to cover it before trusting elength. Backports are available across multiple stable branches. See Linux Kernel Commit 077df84, Linux Kernel Commit 28a924c, Linux Kernel Commit aab1880, Linux Kernel Commit b27e68a, Linux Kernel Commit c22f91d, Linux Kernel Commit c8a109c, and Linux Kernel Commit d585ed0.

Workarounds

Blacklist the ntfs3 kernel module on systems that do not require NTFS support
Disable automatic mounting of removable media in desktop environments and udev rules
Enforce mount policies that require root privileges and validate image provenance before mounting NTFS volumes

bash

# Blacklist the ntfs3 module until patches are applied
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep ntfs3