CVE-2026-89781

8.4 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: The flaw is an out-of-bounds read vulnerability in the Linux kernel's NTFS3 file system driver, which can lead to memory corruption and potential privilege escalation if exploited.
Exploitability: Exploitation requires mounting a crafted NTFS image, making it moderately difficult. Precondition is the availability of a vulnerable Linux kernel version and an attacker with the ability to mount a custom file system.
Blast radius: If exploited, the vulnerability could allow an attacker to read sensitive kernel memory, potentially leading to privilege escalation or other severe consequences.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Linux kernel version 6.1.13 or later.

memory-corruptionprivilege-escalationfile-systemlinux-kernel

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log record into a caller buffer starting at u32 off = lsn_to_page_off(log, lsn) + log->record_header_len; log->record_header_len (and log->data_off, used for the following pages) comes verbatim from the on-disk restart area and is only checked for 8-byte alignment in is_rst_area_valid(), so off can exceed log->page_size. "tail = log->page_size - off" then underflows and memcpy() reads past the page_size-sized buffer returned by read_log_page(), spilling adjacent slab memory into the replay buffer. This is reachable by mounting a crafted NTFS image: BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580 Read of size 64 at addr ffff88800a877ff8 by task exploit/127 read_log_rec_buf fs/ntfs3/fslog.c:2299 log_replay fs/ntfs3/fslog.c:4216 ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324 ntfs_fill_super fs/ntfs3/super.c:1392 get_tree_bdev_flags fs/super.c:1694 __x64_sys_mount fs/namespace.c:4360 The buggy address is located 4088 bytes to the right of the 4096-byte region [ffff88800a876000, ffff88800a877000) Reject an in-page offset outside the current page before the copy. [[email protected]: replaced the >= sign with >]

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.