CVE-2026-89614

ntfs: bound the free-cluster bitmap scan to the volume

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the free-cluster bitmap scan to the volume

vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but
ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.
Those are independent on-disk quantities and the mount-time check only
rejects a $Bitmap that is too small, so an image whose $Bitmap covers more
clusters than the volume has lets the scan index past the array. A run
whose LCN lies in that gap takes the allocator straight there, since the
caller passes the file's own last LCN as its locality hint. KASAN reports
a slab out-of-bounds read when a file on such a volume is extended.

Clamp the scan to what that array covers, mirroring the max_index
calculation the mount-time scan already uses, and reject a decoded LCN
at or beyond nr_clusters in the mapping pairs decoder. Conforming
volumes are unaffected.

Analysis

Technical impact

The flaw occurs in the MS‑NTFS filesystem driver in the Linux kernel. The bitmap size is determined at mount time and is independent from the actual cluster count on the disk. When the bitmap is larger than the volume’s cluster layout the allocator scans past the end of the array. Extending a file triggers this out‑of‑bounds read, which KASAN reports. This read is a classic out‑of‑bounds buffer access (CWE‑125) and may expose kernel memory or cause a crash; the vulnerability does not allow arbitrary code execution.

Affected Systems

All Linux kernels that ship with an unpatched ntfs module are affected. Volumes whose bitmap exceeds the cluster count trigger the issue; volumes with proper bitmaps remain unaffected after the patch.

Risk and Exploitability

The CVSS score of 9.8 indicates high severity. EPSS is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require local privilege or access to a system that mounts a malicious NTFS volume and can manipulate files on it. Consequently, while the potential impact is severe, the overall risk to systems without such an attack vector remains low to moderate, with the primary concern being a possible kernel crash or data disclosure if the conditions are met.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11ccc9107dc460de28af90fac1f42404d9802735`	affected	< dc15a9f5307d5372aef3b64bf3ed7802f530c471
`11ccc9107dc460de28af90fac1f42404d9802735`	affected	< 19cac7902a8ab748e15f98ddaafcf5f8882be21d

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[11ccc9107dc460de28af90fac1f42404d9802735,dc15a9f5307d5372aef3b64bf3ed7802f530c471)`	affected	code_commit	—
`[11ccc9107dc460de28af90fac1f42404d9802735,19cac7902a8ab748e15f98ddaafcf5f8882be21d)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the ntfs bitmap scan patch (commit 19cac7902a8ab748e15f98ddaafcf5f8882be21d).
Disable the ntfs kernel module on systems that do not require NTFS support to eliminate the vulnerability.
Ensure only trusted NTFS volumes with correctly sized bitmaps are used, and avoid extending files on volumes with oversized bitmaps.

Generated by OpenCVE AI on September 15, 2026 at 21:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.553% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d
https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471
https://nvd.nist.gov/vuln/detail/CVE-2026-89614
https://www.cve.org/CVERecord?id=CVE-2026-89614

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89614 https://www.cve.org/CVERecord?id=CVE-2026-89614
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the array. A run whose LCN lies in that gap takes the allocator straight there, since the caller passes the file's own last LCN as its locality hint. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. Clamp the scan to what that array covers, mirroring the max_index calculation the mount-time scan already uses, and reject a decoded LCN at or beyond nr_clusters in the mapping pairs decoder. Conforming volumes are unaffected.
Title		ntfs: bound the free-cluster bitmap scan to the volume
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471