Cloudanix VulnDB

CVE-2026-89611

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux handles certain file attributes on Windows-style disks can let an attacker who supplies a specially made disk image take over the computer or crash it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper validation of name_offset in ntfs_attr_update_meta() allows malicious non-resident NTFS attributes to cause out-of-bounds writes or overlap corruption when converting between sparse and non-sparse forms, because the code does not verify sufficient space for name shifting or the compressed_size field.

Why it matters to the business

Attackers can crash Linux systems, corrupt file-system metadata, or achieve remote code execution on any machine that mounts attacker-controlled NTFS volumes, leading to data loss, service outages, and potential full host compromise.

How an attack unfolds

An attacker supplies a crafted MFT record with an invalid name_offset that places the attribute name at the record boundary or overlapping mapping pairs; when the kernel performs sparse/non-sparse conversion, ntfs_attr_update_meta() writes beyond the allocated attribute record, corrupting adjacent kernel memory and enabling code execution.

How to fix it

Apply the upstream kernel patch that adds name_offset bounds checks and the eight-byte availability test for non-sparse attributes; rebuild and deploy the fixed kernel to all systems that may mount NTFS volumes.

How to confirm the fix worked

Confirm the running kernel contains the validation added for name_offset, named-attribute bounds, and compressed_size space; attempt to mount a test image containing boundary-case attributes and verify no oops or corruption occurs.

Typical attack path

  1. Attacker creates a malicious NTFS image containing a non-resident attribute with crafted name_offset
  2. Victim system mounts the image or processes the MFT record (via file open, fsck, or automated scanning)
  3. Kernel calls ntfs_attr_update_meta() to convert attribute sparsity
  4. Insufficient bounds check allows 8-byte shift or compressed_size insertion to write past the attribute buffer
  5. Memory corruption is leveraged for privilege escalation or persistent access

How to detect it

Monitor kernel logs for oops or BUG messages referencing ntfs_attr_update_meta or non-resident attribute handling; inspect mounted NTFS volumes for unexpected MFT records that trigger conversion during normal file operations.

What your security team should do

  • Patch all Linux kernels to the fixed version immediately given the CVSS 9.8 score and network-facing attack surface
  • Disable NTFS automount for untrusted media until patches are applied
  • Add kernel crash and oops monitoring to detect attempted exploitation
  • Review any systems that regularly process external NTFS images for exposure

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record. However, the validator does not check that name_offset is within safe boundaries for these operations or that the additional space is available. A malicious MFT record could set name_offset such that: 1. The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary. 2. The name overlaps with the mapping pairs, causing corruption during conversion. Add validation to ensure: - For named attributes, name_offset is within valid bounds - Name does not extend beyond the attribute or overlap with mapping pairs - For non-sparse, non-compressed attributes, eight bytes are available after mapping_pairs_offset for the compressed_size field The space check also covers unnamed attributes, for which name_offset = 0 is valid and no name range needs to be checked.

Affected packages

Ecosystem Package Introduced Fixed