Cloudanix VulnDB

CVE-2026-89614

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's NTFS support can let a specially made disk image cause memory errors when files are added, potentially crashing the system or allowing attacks.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in ntfs_cluster_alloc() when scanning the free-cluster bitmap array sized from nr_clusters but bounded only by $Bitmap size, allowing an LCN from a malformed volume to index past the slab allocation.

Why it matters to the business

Systems mounting attacker-supplied NTFS images can experience kernel memory corruption leading to crashes, information leaks, or potential code execution; the flaw affects any Linux deployment handling untrusted volumes with high severity and no public exploits yet.

How an attack unfolds

An attacker creates a crafted NTFS volume whose $Bitmap reports more clusters than the volume's nr_clusters, mounts it on a vulnerable kernel, then triggers file extension that passes a locality hint LCN into the out-of-bounds region, causing the allocator to dereference invalid memory.

How to fix it

Upgrade to a Linux kernel containing the upstream fix that clamps the bitmap scan to vol->lcn_empty_bits_per_page and rejects LCNs at or beyond nr_clusters in the mapping-pairs decoder.

How to confirm the fix worked

Verify the running kernel includes the ntfs bound-free-cluster-bitmap-scan commit; attempt to mount a test image with mismatched bitmap size and confirm no KASAN report or kernel panic occurs on file extension.

Typical attack path

  1. Craft NTFS image with oversized $Bitmap relative to nr_clusters
  2. Mount the image on target system
  3. Perform file write or extension operation that invokes ntfs_cluster_alloc with locality hint
  4. Trigger slab out-of-bounds read during bitmap scan

How to detect it

Search kernel logs and KASAN reports for ntfs_cluster_alloc or lcn_empty_bits_per_page out-of-bounds accesses; correlate with mount operations of NTFS volumes followed by file-extension activity.

  • KASAN: slab-out-of-bounds in ntfs_cluster_alloc
  • ntfs: lcn_empty_bits_per_page
  • mapping pairs decoder: LCN beyond nr_clusters

What your security team should do

  • Apply the patched kernel immediately on all systems that mount external or user-supplied NTFS volumes
  • Harden mount policies to require read-only for untrusted images until patched
  • Monitor kernel logs for KASAN or slab OOB warnings involving ntfs

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the array. A run whose LCN lies in that gap takes the allocator straight there, since the caller passes the file's own last LCN as its locality hint. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. Clamp the scan to what that array covers, mirroring the max_index calculation the mount-time scan already uses, and reject a decoded LCN at or beyond nr_clusters in the mapping pairs decoder. Conforming volumes are unaffected.

Affected packages

Ecosystem Package Introduced Fixed