{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-89615", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.735Z", "datePublished": "2026-09-11T19:45:15.397Z", "dateUpdated": "2026-10-19T08:49:47.839Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:49:47.839Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound page_lcns[] index by the log record\n\nThe copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,\nwhere i runs up to the log record's lcns_follow. That count is checked only\nagainst the record's own length, not the target entry, so check_dp_table()\n(which validates the entry's lcns_follow) does not cover it: the copy_lcns\nentry may even be freshly allocated after that check, and find_dp() bounds j\nbut not i. A crafted record thus overflows page_lcns[] of an otherwise valid\nentry.\n\nAdd dp_range_ok() and reject, before each loop, any record whose run does\nnot fit the entry. These are the only two page_lcns[] accesses indexed by\nthe record rather than the entry, so together with the entry validation\nevery access is now bounded.\n\n[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The page_lcns[] overflow is reached only in log_replay() on the local ntfs3 mount path (path_mount→ntfs_fill_super→ntfs_loadlog_and_replay→log_replay). ksmbd/nfsd never parse $LogFile; journal replay runs at fill_super, not while serving exported files.\nAC:L - An attacker fully controls crafted $LogFile LOG_REC_HDR fields (target_vcn, lcns_follow) and the target DIR_PAGE_ENTRY. find_dp() only bounds the base index j; the redo shorten loop then indexes page_lcns[j+i-1] with i up to the record's lcns_follow, so the OOB access is deterministic with no race.\nPR:N - No account or privilege on the victim is required: a crafted NTFS volume on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to run $LogFile replay as root.\nUI:N - Desktop, kiosk, and shared-workstation automounters mount attacker-supplied NTFS media and run log_replay() inside ntfs_fill_super() without the user opening files or confirming a dialog; attaching the crafted volume is sufficient to trigger the overflow.\nS:U - Heap out-of-bounds page_lcns[] access occurs in the host kernel during ntfs3 journal replay in the mounting process; impact stays within one kernel security authority and is not a VM escape or IOMMU/DMA bypass.\nC:H - The redo shorten loop reads dp->page_lcns[j+i-1] with i taken from the log record's lcns_follow (u16, up to 65535 entries / ~512KB past the DIR_PAGE_ENTRY). That unbounded slab out-of-bounds read of adjacent heap is Confidentiality High per kernel OOB-read guidance.\nI:H - On unfixed kernels the copy_lcns analysis loop wrote attacker-controlled __le64 values past page_lcns[], a heap OOB write. Independently, OOB page_lcns[] reads in the redo pass control dlen passed to do_action() memcpy/memmove into MFT and index buffers, enabling further kernel writes.\nA:H - Indexing far past the kmalloc-backed DIR_PAGE_ENTRY in log_replay() on mount can fault unmapped adjacent slab memory, causing a kernel oops or panic. The crash is repeatable on every mount of the crafted NTFS volume." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ntfs3/fslog.c" ], "versions": [ { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "31fdd11f75da9823500168cecb07aa45130915a3", "status": "affected", "versionType": "git" }, { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "bb742d1030864c0fe140666f639428ba4e90b2ca", "status": "affected", "versionType": "git" }, { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "61ca8cbbf68f77f25b699ed4358bd232f94ed43b", "status": "affected", "versionType": "git" }, { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "f4c1bc6d7331f344ffcea93c2a37badcbe15baa6", "status": "affected", "versionType": "git" }, { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "7ccb94901f38a062034b56b43c774050b113758f", "status": "affected", "versionType": "git" }, { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "1135ebc225996b3ac1a295652b19a0a706737a6c", "status": "affected", "versionType": "git" }, { "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "6f7b9dbdc1b7520206abce0049bdd143eb536e75", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ntfs3/fslog.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.221" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.188" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.109" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.50" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/31fdd11f75da9823500168cecb07aa45130915a3" }, { "url": "https://git.kernel.org/stable/c/bb742d1030864c0fe140666f639428ba4e90b2ca" }, { "url": "https://git.kernel.org/stable/c/61ca8cbbf68f77f25b699ed4358bd232f94ed43b" }, { "url": "https://git.kernel.org/stable/c/f4c1bc6d7331f344ffcea93c2a37badcbe15baa6" }, { "url": "https://git.kernel.org/stable/c/7ccb94901f38a062034b56b43c774050b113758f" }, { "url": "https://git.kernel.org/stable/c/1135ebc225996b3ac1a295652b19a0a706737a6c" }, { "url": "https://git.kernel.org/stable/c/6f7b9dbdc1b7520206abce0049bdd143eb536e75" } ], "title": "fs/ntfs3: bound page_lcns[] index by the log record", "x_generator": { "engine": "bippy-1.2.0" } } } }