CVE-2026-89782: Linux Kernel NTFS3 Use-After-Free Vulnerability

CVE-2026-89782 Overview

CVE-2026-89782 is a Linux kernel vulnerability in the fs/ntfs3 filesystem driver. The flaw lives in the $LogFile replay path, where log_replay() indexes the transaction table using a transact_id value taken directly from the log record header. A crafted NTFS image can request an arbitrarily large index, causing alloc_rsttbl_from_idx() to trigger an integer truncation when growing the restart table. The result is an out-of-bounds write past the allocation, reachable simply by mounting the malicious image.

Critical Impact
A local attacker able to mount a crafted NTFS image can trigger a kernel out-of-bounds write, leading to memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel with the ntfs3 filesystem driver enabled
Distributions shipping vulnerable pre-patch fs/ntfs3 code
Systems permitting mounting of user-supplied NTFS images (including removable media and disk images)

Discovery Timeline

2026-09-16 - CVE-2026-89782 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89782

Vulnerability Analysis

The vulnerability sits in the NTFS3 log replay logic in fs/ntfs3/fslog.c. During $LogFile replay, log_replay() uses the transact_id field from a log record header as an index into the transaction restart table. The validator check_log_rec() only confirms that transact_id is non-zero and correctly aligned. It never bounds-checks its magnitude, so a crafted image can supply an index far larger than any legitimate table would hold.

When the requested index exceeds the current table size, alloc_rsttbl_from_idx() calls extend_rsttbl() to grow the table. extend_rsttbl() computes the new entry count as used + add in a u32, then passes the result to init_rsttbl() via rt = init_rsttbl(esize, used + add);. The problem is that init_rsttbl() accepts a u16, and the count is stored as a __le16 inside struct RESTART_TABLE.

When used + add exceeds U16_MAX, the value is truncated on the way into init_rsttbl(). The allocator produces a table sized for the truncated count, but alloc_rsttbl_from_idx() then dereferences and writes using the original untruncated offset. KASAN observes this as a use-after-free style out-of-bounds read at alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) during ntfs_fill_super().

Root Cause

The root cause is a numeric truncation error [CWE-197] between the u32 growth calculation and the u16 restart table entry count. Because a restart table is architecturally capped at U16_MAX entries by its __le16 count field, any growth request beyond that limit is invalid but was silently accepted. The mismatch produces an undersized allocation that is later indexed at the original, oversized offset, resulting in an out-of-bounds write past the heap allocation.

Attack Vector

Exploitation requires local access with the ability to mount an attacker-controlled NTFS image. This includes plugging in removable media, mounting a loopback file, or automounting via user-session services on distributions that permit it. No authentication or user interaction is required beyond the mount itself, and the corruption occurs during ntfs_fill_super() before user-space interaction with the filesystem begins.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present on the CISA KEV list. Technical details are available in the upstream fix commits referenced by the Linux kernel maintainers.

For commit-level analysis, see the Linux Kernel Commit 111f8d74 and the parallel stable backports Linux Kernel Commit 339e5999, Linux Kernel Commit 967a5ff8, and Linux Kernel Commit aad605a4.

Detection Methods for CVE-2026-89782

Indicators of Compromise

KASAN reports referencing alloc_rsttbl_from_idx or log_replay in fs/ntfs3/fslog.c in kernel logs
Kernel oops or panic traces originating from ntfs_fill_super or ntfs_loadlog_and_replay shortly after an NTFS mount attempt
Unexpected mounts of NTFS volumes from removable media or disk images by non-administrative users

Detection Strategies

Monitor dmesg and /var/log/kern.log for NTFS3 driver crashes, KASAN warnings, or general protection faults in the log replay path
Audit mount syscall telemetry for ntfs3 filesystem type invocations, correlating with the source device and initiating process
Inventory Linux hosts with CONFIG_NTFS3_FS enabled to scope exposure across the fleet

Monitoring Recommendations

Enable auditd rules on the mount syscall to capture NTFS mount events with user, process, and device context
Forward kernel ring buffer events to a centralized logging platform for correlation and anomaly detection
Alert on repeated NTFS3 driver faults from the same host or user, which may indicate exploitation attempts

How to Mitigate CVE-2026-89782

Immediate Actions Required

Apply the upstream Linux kernel patches or the vendor-provided kernel update that includes the extend_rsttbl() bounds check
Restrict which users can mount NTFS filesystems, particularly from removable media and user-controlled image files
Disable automounting of untrusted NTFS volumes on servers and shared workstations until patches are deployed

Patch Information

The fix rejects any restart table growth request that exceeds U16_MAX entries inside extend_rsttbl(). All existing callers already handle a NULL return, so the correction is contained to the growth path. Fix commits are published in the stable tree, including Linux Kernel Commit be218a01, Linux Kernel Commit caa0ec3f, and Linux Kernel Commit ecde45cd. Administrators should install the distribution kernel package that incorporates these commits and reboot affected hosts.

Workarounds

Unload the ntfs3 module (modprobe -r ntfs3) and blocklist it on systems that do not require NTFS support
Enforce noauto and nosuid,nodev,noexec on any NTFS entries in /etc/fstab and disallow user-space automount daemons from handling NTFS
Restrict physical access and removable media policies to prevent untrusted images from being mounted by unprivileged users

bash

# Configuration example: disable the ntfs3 driver until patched
sudo modprobe -r ntfs3
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf
sudo update-initramfs -u

# Restrict udisks2 automounting of NTFS volumes for non-admin users
# /etc/polkit-1/rules.d/10-restrict-ntfs-mount.rules
# polkit.addRule(function(action, subject) {
#     if (action.id == "org.freedesktop.udisks2.filesystem-mount" &&
#         action.lookup("id.type") == "ntfs") {
#         return polkit.Result.AUTH_ADMIN;
#     }
# });