CVE-2026-89782fs/ntfs3: reject restart table growth beyond U16_MAX entries
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_rec() only verifies that transact_id is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily large index. alloc_rsttbl_from_idx() grows the table to cover that index via extend_rsttbl(), which passes the new entry count to init_rsttbl(): rt = init_rsttbl(esize, used + add); used + add is computed as u32 but init_rsttbl() takes a u16, and the count is stored in struct RESTART_TABLE as a __le16. When used + add exceeds U16_MAX it is truncated, init_rsttbl() allocates a table far smaller than the index requires, and alloc_rsttbl_from_idx() then dereferences and writes at the original, untruncated offset -- an out-of-bounds access past the allocation, reachable by mounting a crafted NTFS image. BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) Read of size 4 at addr ffff8880327ffff8 by task exploit alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) log_replay (fs/ntfs3/fslog.c:4562) ntfs_loadlog_and_replay (fs/ntfs3/fsntfs.c:324) ntfs_fill_super (fs/ntfs3/super.c:1393) get_tree_bdev_flags vfs_get_tree path_mount __x64_sys_mount A restart table is limited to U16_MAX entries by its __le16 count, so a larger growth request is invalid input. Reject it in extend_rsttbl(); all callers already handle a NULL return.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b46acd6a6a627d876898e1c84d3f84902264b445 before caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56; from b46acd6a6a627d876898e1c84d3f84902264b445 before 339e59996ff193adcf1c438cf05f19e753beb3a7; from b46acd6a6a627d876898e1c84d3f84902264b445 before ecde45cd81dc28f5696c312c5ce5a509962e9ab1; from b46acd6a6a627d876898e1c84d3f84902264b445 before be218a01aadffe33ed4fc73e25276d676ebbd09d; from b46acd6a6a627d876898e1c84d3f84902264b445 before aad605a450611e2a7b7cf9dd5724004d39192bfb; from b46acd6a6a627d876898e1c84d3f84902264b445 before 967a5ff8a614d10126b6d46db1ac040948d6cb42; from b46acd6a6a627d876898e1c84d3f84902264b445 before 111f8d74a19d85942ecbb3aba78f6f3c88e59391 | CNA record |
References
- https://git.kernel.org/stable/c/caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56
- https://git.kernel.org/stable/c/339e59996ff193adcf1c438cf05f19e753beb3a7
- https://git.kernel.org/stable/c/ecde45cd81dc28f5696c312c5ce5a509962e9ab1
- https://git.kernel.org/stable/c/be218a01aadffe33ed4fc73e25276d676ebbd09d
- https://git.kernel.org/stable/c/aad605a450611e2a7b7cf9dd5724004d39192bfb
- https://git.kernel.org/stable/c/967a5ff8a614d10126b6d46db1ac040948d6cb42
- https://git.kernel.org/stable/c/111f8d74a19d85942ecbb3aba78f6f3c88e59391
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.