CVE-2026-89610

What it actually does

The mapping pairs decoder in the NTFS driver validates only that the starting LCN lies inside the volume and omits a check that lcn + length remains within nr_clusters, allowing a malformed on-disk run list to trigger out-of-bounds memory accesses.

Why it matters to the business

Systems that mount untrusted or attacker-supplied NTFS volumes risk kernel memory corruption that can be escalated to full host compromise, data theft, or persistent malware installation.

How an attack unfolds

An attacker prepares an NTFS image containing a crafted mapping-pairs array whose run length extends past the volume end. When the image is mounted or a file is accessed, the decoder performs an unchecked access beyond the volume boundary, corrupting kernel memory and enabling privilege escalation to root.

How to fix it

Apply the upstream kernel patch that adds the lcn + length <= nr_clusters validation, or upgrade to a distribution kernel that contains the fix.

How to confirm the fix worked

Confirm the presence of the boundary check in fs/ntfs/runlist.c (or equivalent) and test mount/repair operations against a crafted image that previously triggered the overflow.

Typical attack path

1. Create a malicious NTFS filesystem image with an oversized run length in the mapping-pairs array
2. Deliver the image to the target (USB, network share, email attachment)
3. Induce the victim kernel to mount the image or access files on it
4. Trigger the decoder path that reads or writes past the volume boundary
5. Leverage the resulting memory corruption for code execution and privilege escalation

How to detect it

Review kernel logs (dmesg, syslog) for NTFS run-list or mapping-pairs errors, out-of-bounds warnings, or unexpected oops/panic entries that coincide with NTFS mount events; correlate with subsequent privilege-escalation artifacts.

What your security team should do

• Expedite kernel updates on any host that may mount external NTFS volumes
• Disable automatic mounting of removable media and require explicit user approval
• Add kernel memory-corruption and NTFS-related alerts to the SIEM for rapid triage