CVE-2026-89781: Linux Kernel NTFS3 Buffer Overflow Vulnerability

CVE-2026-89781 Overview

CVE-2026-89781 is an out-of-bounds read vulnerability in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in the read_log_rec_buf() function, which processes NTFS log records during filesystem replay. The function computes an offset using log->record_header_len, a value read verbatim from the on-disk restart area and validated only for 8-byte alignment in is_rst_area_valid(). A crafted NTFS image can force the offset to exceed log->page_size, causing an integer underflow in the tail calculation and a subsequent memcpy() that reads adjacent slab memory into the replay buffer.

Critical Impact
Local attackers with the ability to mount a crafted NTFS image can trigger a kernel out-of-bounds read, potentially leaking adjacent slab memory and destabilizing the kernel.

Affected Products

Linux kernel fs/ntfs3 filesystem driver (upstream)
Linux distributions shipping kernels with the NTFS3 driver enabled
Systems allowing mount operations on untrusted NTFS filesystem images

Discovery Timeline

2026-09-16 - CVE-2026-89781 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89781

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in read_log_rec_buf() located in fs/ntfs3/fslog.c. When the kernel replays the NTFS log during mount, read_log_rec_buf() computes:

u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;

Because log->record_header_len originates from the on-disk restart area and is only validated for 8-byte alignment, an attacker-controlled NTFS image can supply a value large enough that off exceeds log->page_size. The subsequent expression tail = log->page_size - off then underflows to a very large unsigned value. The following memcpy() reads beyond the 4096-byte page buffer returned by read_log_page(), copying adjacent slab memory into the caller-supplied replay buffer.

KASAN confirms the issue with a slab-out-of-bounds read of 64 bytes located 4088 bytes past the end of a 4096-byte allocation. The bug reaches the kernel through the mount(2) syscall path: __x64_sys_mount → ntfs_fill_super → ntfs_loadlog_and_replay → log_replay → read_log_rec_buf.

Root Cause

The root cause is insufficient validation of on-disk metadata. The restart area's record_header_len and data_off fields are trusted after only an alignment check. No bounds check ensures the resulting offset stays within log->page_size, allowing an integer underflow to drive the read length.

Attack Vector

Exploitation requires local access and the ability to trigger a mount of a crafted NTFS filesystem image. This is reachable on systems that permit users or automated services to mount removable media, disk images, or user-supplied block devices. Successful triggering leaks adjacent kernel slab memory into the replay buffer and may crash the kernel, depending on allocator state and hardening features.

No verified public exploit code is available. See the upstream patch commits for the technical fix.

Detection Methods for CVE-2026-89781

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in read_log_rec_buf in kernel logs
Kernel oops or panic traces containing log_replay, ntfs_loadlog_and_replay, or ntfs_fill_super
Unexpected mount failures or crashes shortly after inserting removable NTFS media

Detection Strategies

Audit kernel version and NTFS3 driver build against the fixed commits listed in the upstream references.
Monitor dmesg and journal output for NTFS3 warnings, KASAN splats, or filesystem replay errors.
Track mount syscalls with filesystem type ntfs3 originating from non-root users or automated mounters.

Monitoring Recommendations

Enable kernel telemetry that captures mount events, kernel panics, and slab allocator warnings.
Alert on repeated mount attempts of NTFS images from a single user or process within a short window.
Forward kernel logs to a centralized SIEM for correlation with removable-media and USB insertion events.

How to Mitigate CVE-2026-89781

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits as soon as vendor builds are available.
Restrict the ability of unprivileged users to mount NTFS filesystems, including via udisks, autofs, and desktop automounters.
Disable the ntfs3 kernel module on systems that do not require NTFS support.

Patch Information

The fix rejects any in-page offset that falls outside the current page before the memcpy(). Upstream commits addressing the issue include Kernel Git Commit 1b2d31f, Kernel Git Commit 49f7cbc, Kernel Git Commit 53e56f7, Kernel Git Commit 700973c, Kernel Git Commit 74a83aa, Kernel Git Commit de603b9, and Kernel Git Commit df099bf.

Workarounds

Blacklist the ntfs3 module where NTFS support is not required.
Enforce policy so only root can mount block devices and disk images.
Prevent automatic mounting of removable media on multi-user or shared systems.

bash

# Blacklist the ntfs3 module and prevent automatic loading
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
echo "install ntfs3 /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep ntfs3