CVE-2026-89613

What it actually does

The kernel NTFS driver failed to reject attributes containing empty mapping pairs when the highest VCN and attribute size were inconsistent, allowing malformed on-disk structures to reach internal parsing logic.

Why it matters to the business

Systems that mount untrusted NTFS volumes (USB drives, network shares, forensic images) risk kernel crashes or memory corruption; the low EPSS and absence from KEV indicate limited real-world exploitation so far, but the high CVSS warrants prompt patching of production Linux systems.

How an attack unfolds

An attacker crafts an NTFS-formatted volume containing an attribute record with empty mapping pairs and mismatched highest VCN/size values, then causes a victim kernel to parse the volume (via mount, file-system utilities, or automated scanning); the missing validation previously allowed the inconsistent data to propagate into allocation or lookup routines.

How to fix it

Update to a Linux kernel containing the fix that rejects attributes with empty mapping pairs on inconsistent highest VCN and size; apply the change via distribution security updates as soon as available.

How to confirm the fix worked

Confirm the running kernel contains the ntfs mapping-pair validation commit; test by attempting to mount a crafted volume containing the previously accepted invalid attribute and verify the mount is rejected with an error rather than proceeding or crashing.

Typical attack path

1. Prepare a malicious NTFS image with an attribute record that declares empty mapping pairs yet inconsistent highest VCN and size fields.
2. Deliver the image to the target (USB, network share, downloaded archive).
3. Trigger kernel parsing of the volume through mount, fsck, indexing service, or forensic tool.
4. Observe denial-of-service or attempt to leverage resulting memory state for code execution.

How to detect it

Review kernel logs for NTFS attribute parsing warnings or oopses around the time external volumes were mounted; look for mount attempts of volumes that later exhibit file-system errors.

What your security team should do

• Prioritize kernel updates on any system that may mount external NTFS media.
• Disable automatic mounting of removable NTFS volumes where operationally feasible.
• Monitor upstream kernel changelogs for the exact commit that added the empty-mapping-pair rejection.