CVE-2026-89612

ntfs: reject invalid MFT LCNs from boot sector

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid MFT LCNs from boot sector

The NTFS boot sector stores the MFT and MFTMirr locations as unsigned
64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64.

A crafted high-bit value could therefore become negative and pass
the existing upper-bound check. The invalid value then propagated into
the MFT zone allocator and could result in an out-of-bounds access to
lcn_empty_bits_per_page.

Analysis

Technical impact

The Linux kernel NTFS module parses the boot sector of an NTFS volume and treats the MFT and MFTMirr locations, stored as unsigned 64‑bit logical cluster numbers, as signed 64‑bit values. If a crafted high‑bit value becomes negative and passes the existing upper‑bound check, the negative index is then used by the MFT zone allocator, producing an out‑of‑bounds access to the array lcn_empty_bits_per_page. This flaw (CWE‑787) can corrupt kernel memory and potentially lead to a crash or information disclosure.

Affected Systems

Any Linux kernel release that predates the inclusion of commit 8f8420b68a6f05ca2b03779d8208814ec539b9e5 is vulnerable. Distributions built on those kernels without applying the patch remain affected. The vulnerability applies to all components that enable NTFS support in the kernel.

Risk and Exploitability

The CVSS score of 9.8 signifies an Extremely High severity. The EPSS score of < 1% indicates that, while the flaw is critical, the likelihood of exploitation in the wild is low. The issue is not listed in the CISA KEV catalog. Based on the description, exploitation would require a malicious NTFS boot sector that the kernel parses, which generally demands local or privileged access to mount or otherwise inject the boot sector into the kernel’s parsing path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11ccc9107dc460de28af90fac1f42404d9802735`	affected	< 8f8420b68a6f05ca2b03779d8208814ec539b9e5
`11ccc9107dc460de28af90fac1f42404d9802735`	affected	< cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[11ccc9107dc460de28af90fac1f42404d9802735,8f8420b68a6f05ca2b03779d8208814ec539b9e5)`	affected	code_commit	—
`[11ccc9107dc460de28af90fac1f42404d9802735,cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that contains commit 8f8420b68a6f05ca2b03779d8208814ec539b9e5 or a later release that incorporates the fix.
If a kernel upgrade cannot be done immediately, disable NTFS support in the kernel configuration (for example, by removing the ntfs module or setting the kernel config option to off) or restrict NTFS mount operations to trusted users only.
When NTFS support must remain, mount the filesystem with the read‑only option and ensure volumes originate from trusted sources.

Generated by OpenCVE AI on September 15, 2026 at 21:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.553% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/8f8420b68a6f05ca2b03779d8208814ec539b9e5
https://git.kernel.org/stable/c/cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2
https://nvd.nist.gov/vuln/detail/CVE-2026-89612
https://www.cve.org/CVERecord?id=CVE-2026-89612

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89612 https://www.cve.org/CVERecord?id=CVE-2026-89612
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.
Title		ntfs: reject invalid MFT LCNs from boot sector
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/8f8420b68a6f05ca2b03779d8208814ec539b9e5 https://git.kernel.org/stable/c/cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2