CVE-2026-89779fs/ntfs3: validate ef->size covers the record's name and value
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength. A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr(): BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94) The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96 Compute the size the record needs and require ef->size to cover it.
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 333feb7ba84f69f9b423422417aaac54fd9e7c84 before b27e68ad818a4ca2cef8f35f97e75d756714c818; from 000a9a72efa4a9df289bab9c9e8ba1639c72e0d6 before 28a924c7e67e6d71abeb04860b61166fecb027fc; from 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b before d585ed08308909c7e6fefb4e8a258aeb29b19ff9; from 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b before 077df8464cf24f8ffc82fb6efec2ae600686e699; from 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b before aab1880058ac767d3ea9388a9a7221c776c22c44; from 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b before c8a109c9e23a2c7fd548473dde728b2cb8188146; from 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b before c22f91d82cb9a29d22bdffdce6c803467984ad0c; from 5.15.121 before 5.15.221; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/b27e68ad818a4ca2cef8f35f97e75d756714c818
- https://git.kernel.org/stable/c/28a924c7e67e6d71abeb04860b61166fecb027fc
- https://git.kernel.org/stable/c/d585ed08308909c7e6fefb4e8a258aeb29b19ff9
- https://git.kernel.org/stable/c/077df8464cf24f8ffc82fb6efec2ae600686e699
- https://git.kernel.org/stable/c/aab1880058ac767d3ea9388a9a7221c776c22c44
- https://git.kernel.org/stable/c/c8a109c9e23a2c7fd548473dde728b2cb8188146
- https://git.kernel.org/stable/c/c22f91d82cb9a29d22bdffdce6c803467984ad0c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.