Cloudanix VulnDB

CVE-2026-89612

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux reads certain disk layout numbers from NTFS drives lets an attacker who supplies a specially made drive take over the computer.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper validation of 64-bit LCN values read from the NTFS boot sector allows a high-bit-set value to be sign-extended into a negative s64; the negative value bypasses the upper-bound check and is later used as an index into lcn_empty_bits_per_page, resulting in an out-of-bounds memory access during MFT zone allocation.

Why it matters to the business

Systems that mount attacker-supplied NTFS volumes can be fully compromised, leading to data theft, ransomware deployment, or persistent access with no user interaction required.

How an attack unfolds

An attacker crafts an NTFS boot sector containing an MFT LCN with the high bit set, distributes the image via USB, network share, or malicious download, and waits for a vulnerable kernel to mount the volume; the kernel's parse_ntfs_boot_sector function accepts the invalid LCN, which later triggers the out-of-bounds access in the MFT allocator.

How to fix it

Upgrade to a kernel containing the upstream commit that adds explicit rejection of invalid MFT LCNs in parse_ntfs_boot_sector; rebuild and reboot affected systems; until patches are available, avoid mounting untrusted NTFS volumes.

How to confirm the fix worked

Verify the running kernel contains the fix by inspecting the ntfs module source or changelog for the 'reject invalid MFT LCNs' change; attempt to mount a test image containing a high-bit LCN and confirm the mount is rejected with an error rather than proceeding to allocator code.

Typical attack path

  1. Craft NTFS boot sector with high-bit MFT LCN value
  2. Deliver malicious volume to target (USB, network share, download)
  3. Victim kernel mounts the volume
  4. parse_ntfs_boot_sector converts LCN to negative s64
  5. MFT zone allocator indexes lcn_empty_bits_per_page with negative value
  6. Out-of-bounds read/write occurs, enabling code execution or crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for ntfs mount failures or oops messages referencing MFT LCN or lcn_empty_bits_per_page; correlate with file-system mount events from auditd or systemd logs; look for unexpected NTFS volume mounts from removable media or network paths.

What your security team should do

  • Prioritize kernel updates for any system that can mount NTFS volumes
  • Add policy to block or sandbox mounting of removable and network NTFS media until patched
  • Monitor kernel logs for ntfs-related oops or warnings on systems that must remain unpatched

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.

Affected packages

Ecosystem Package Introduced Fixed