{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-89616", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.735Z", "datePublished": "2026-09-11T19:45:16.064Z", "dateUpdated": "2026-10-19T08:49:48.800Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:49:48.800Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()'s return value:\n\n unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n frame_size);\n if ((ssize_t)unc_size < 0) err = unc_size;\n else if (!unc_size || unc_size > frame_size) err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file's\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ni_read_frame() runs from ntfs_read_folio on LZNT-compressed reads. ntfs3 registers export_operations, so ksmbd/nfsd vfs_read and splice on an exported NTFS volume reach this path and return leaked page-cache bytes to a remote SMB/NFS client on NAS and hybrid file-server deployments.\nAC:L - A crafted NTFS image fully controls the on-disk LZNT stream; a zero chunk header makes decompress_lznt() return far fewer than frame_size bytes deterministically, with no race, rare config, or attacker-uncontrollable memory layout required.\nPR:N - A remote client can trigger the leak by reading a world-readable compressed file over NFS (AUTH_SYS/guest) or a ksmbd guest share with no local account or capability on the host; ntfs3 file-read paths check only inode state, not privileges.\nUI:N - After the NTFS volume is mounted and exported—the normal state for NAS, dual-boot, and automounted removable NTFS—the attacker only issues reads; no further victim action such as opening a file or confirming a prompt is required.\nS:U - The leak exposes the host kernel's own freed page contents through that kernel's page cache to the reader and does not cross a VM, guest-to-host, IOMMU, or other security-authority boundary.\nC:H - Each crafted frame can disclose up to the uncompressed LZNT unit (typically 64KiB) of uninitialized recently-freed kernel page memory, repeatable across the file, including kernel pointers for KASLR bypass and residual secrets rather than a small bounded read.\nI:N - The defect only leaves the decompressed-frame tail unzeroed in the file's own page-cache pages; it does not perform an out-of-bounds write, corrupt kernel objects, or yield a write or control-flow hijack primitive.\nA:N - Partial LZNT decompress is treated as success; pages are marked uptodate and the read returns data without a kernel oops, panic, hang, deadlock, or other availability loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ntfs3/frecord.c" ], "versions": [ { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "7d60a4c49af4d5cb88aa7cbf998d0408bd415055", "status": "affected", "versionType": "git" }, { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "cd40eee4923d104ebec9ac7513b971bc441e431d", "status": "affected", "versionType": "git" }, { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "77d8efd04745cda23858546afdbd9d07b591758e", "status": "affected", "versionType": "git" }, { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea", "status": "affected", "versionType": "git" }, { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "376ee45659a4b943df672ad275c63da00655f929", "status": "affected", "versionType": "git" }, { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "4a1b39b2e10eb8de86265e80cf2be4396bc1dce4", "status": "affected", "versionType": "git" }, { "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ntfs3/frecord.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.221" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.188" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.109" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.50" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055" }, { "url": "https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d" }, { "url": "https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e" }, { "url": "https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea" }, { "url": "https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929" }, { "url": "https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4" }, { "url": "https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd" } ], "title": "fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()", "x_generator": { "engine": "bippy-1.2.0" } } } }