CVE-2026-89785: Linux Kernel NTFS3 Buffer Overflow Flaw

CVE-2026-89785 Overview

CVE-2026-89785 is an out-of-bounds read vulnerability in the Linux kernel ntfs3 filesystem driver. The flaw resides in ntfs_reparse_init() and ntfs_objid_init(), which parse the INDEX_ROOT attributes ($R and $O) of the $Extend/$Reparse and $Extend/$ObjId metafiles. These functions call resident_data() without verifying that the resident attribute is large enough to hold the INDEX_ROOT structure. Mounting a crafted NTFS image triggers a KASAN slab-out-of-bounds read when the kernel accesses root->type and root->rule beyond the record buffer. Exploitation requires CAP_SYS_ADMIN because the flaw is only reachable during filesystem mount.

Critical Impact
A local privileged user or attacker able to trigger the mount of a malicious NTFS image can cause out-of-bounds kernel memory reads leading to information disclosure or kernel crash.

Affected Products

Linux kernel fs/ntfs3 filesystem driver
Distributions shipping vulnerable versions of the ntfs3 module
Systems allowing untrusted NTFS image mounts (including automounters processing removable media)

Discovery Timeline

2026-09-16 - CVE-2026-89785 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89785

Vulnerability Analysis

The ntfs3 driver reads the INDEX_ROOT attribute from NTFS metafiles during mount. Both ntfs_reparse_init() and ntfs_objid_init() invoke resident_data() to obtain a pointer to the resident attribute's payload. The helper performs no size validation against the INDEX_ROOT structure. Because mi_enum_attr() accepts an attribute where data_off == asize and data_size == 0, a crafted attribute placed last in its MFT record yields a pointer to the end of the record_size buffer. Subsequent field accesses read past the allocation.

The issue is classified as an Out-of-Bounds Read [CWE-125]. KASAN reports the fault as slab-out-of-bounds in ntfs_reparse_init with a 4-byte read at the affected slab address. The upstream fix replaces resident_data() with resident_data_ex(attr, sizeof(struct INDEX_ROOT)), aligning behavior with ntfs_security_init() for $SDH and $SII, and bails out when the helper returns NULL.

Root Cause

The root cause is missing bounds validation in the resident attribute parser. resident_data() returns a payload pointer without ensuring the attribute contains enough bytes for the caller's target structure. When the MFT record ends immediately after the attribute header, the returned pointer references memory outside the allocated record buffer.

Attack Vector

An attacker crafts a malicious NTFS image with a truncated $R or $OINDEX_ROOT attribute. Mounting the image via mount() walks the code path from ntfs_fill_super() into ntfs_reparse_init() or ntfs_objid_init(). The kernel then reads root->type and root->rule beyond the record buffer. The attack requires CAP_SYS_ADMIN, so exposure depends on local privilege boundaries and automount configurations.

// Vulnerability described in prose only. See upstream commits for the patch diff.
// Reference: https://git.kernel.org/stable/c/64bb6000bfbdf241a6dd578199acd90321a4243e

Detection Methods for CVE-2026-89785

Indicators of Compromise

KASAN reports of slab-out-of-bounds in ntfs_reparse_init or ntfs_objid_init in dmesg or kernel logs
Unexpected kernel oops or panic entries with call stacks traversing ntfs_fill_super and path_mount
Mount attempts of NTFS images originating from untrusted removable media or user-provided files

Detection Strategies

Audit kernel logs for KASAN or general protection fault entries referencing fs/ntfs3/fsntfs.c
Monitor mount syscalls that specify ntfs3 as the filesystem type from non-administrative sessions
Correlate CAP_SYS_ADMIN usage with NTFS mount events to identify anomalous filesystem operations

Monitoring Recommendations

Ship kernel ring buffer messages to a centralized log store and alert on ntfs3 fault signatures
Track loading of the ntfs3 module on hosts that do not require NTFS support
Review udev and automount rules that mount removable media without user interaction

How to Mitigate CVE-2026-89785

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits
Restrict CAP_SYS_ADMIN and disable unattended automounting of untrusted NTFS media
Blocklist the ntfs3 kernel module on systems that do not need NTFS support

Patch Information

The fix replaces resident_data() calls in ntfs_reparse_init() and ntfs_objid_init() with resident_data_ex(attr, sizeof(struct INDEX_ROOT)) and returns early on NULL. Vendor stable trees have merged the change across multiple branches. Consult the referenced Kernel Git Commit Fix and related stable commits (Update, Improvement, Change, Refactor, Enhancement, Release) for the specific series applicable to your kernel.

Workarounds

Blacklist ntfs3 with /etc/modprobe.d/blacklist-ntfs3.conf on hosts that do not mount NTFS volumes
Disable automounting of removable media and require administrator approval for mount operations
Use user namespace and seccomp policies to prevent unprivileged workloads from invoking NTFS mounts

bash

# Prevent the vulnerable module from loading
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo modprobe -r ntfs3 2>/dev/null || true