Description
In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the free-cluster bitmap scan to the volume

vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but
ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.
Those are independent on-disk quantities and the mount-time check only
rejects a $Bitmap that is too small, so an image whose $Bitmap covers more
clusters than the volume has lets the scan index past the array. A run
whose LCN lies in that gap takes the allocator straight there, since the
caller passes the file's own last LCN as its locality hint. KASAN reports
a slab out-of-bounds read when a file on such a volume is extended.

Clamp the scan to what that array covers, mirroring the max_index
calculation the mount-time scan already uses, and reject a decoded LCN
at or beyond nr_clusters in the mapping pairs decoder. Conforming
volumes are unaffected.
Published: 2026-09-11
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Kernel out‑of‑bounds read (CWE‑125) potentially causing crash or memory disclosure
Action: Patch Kernel
AI Analysis

Impact

The flaw occurs in the MS‑NTFS filesystem driver in the Linux kernel. The bitmap size is determined at mount time and is independent from the actual cluster count on the disk. When the bitmap is larger than the volume’s cluster layout the allocator scans past the end of the array. Extending a file triggers this out‑of‑bounds read, which KASAN reports. This read is a classic out‑of‑bounds buffer access (CWE‑125) and may expose kernel memory or cause a crash; the vulnerability does not allow arbitrary code execution.

Affected Systems

All Linux kernels that ship with an unpatched ntfs module are affected. Volumes whose bitmap exceeds the cluster count trigger the issue; volumes with proper bitmaps remain unaffected after the patch.

Risk and Exploitability

The CVSS score of 9.8 indicates high severity. EPSS is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require local privilege or access to a system that mounts a malicious NTFS volume and can manipulate files on it. Consequently, while the potential impact is severe, the overall risk to systems without such an attack vector remains low to moderate, with the primary concern being a possible kernel crash or data disclosure if the conditions are met.

Generated by OpenCVE AI on September 15, 2026 at 21:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel update that includes the ntfs bitmap scan patch (commit 19cac7902a8ab748e15f98ddaafcf5f8882be21d).
  • Disable the ntfs kernel module on systems that do not require NTFS support to eliminate the vulnerability.
  • Ensure only trusted NTFS volumes with correctly sized bitmaps are used, and avoid extending files on volumes with oversized bitmaps.

Generated by OpenCVE AI on September 15, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the array. A run whose LCN lies in that gap takes the allocator straight there, since the caller passes the file's own last LCN as its locality hint. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. Clamp the scan to what that array covers, mirroring the max_index calculation the mount-time scan already uses, and reject a decoded LCN at or beyond nr_clusters in the mapping pairs decoder. Conforming volumes are unaffected.
Title ntfs: bound the free-cluster bitmap scan to the volume
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:31:52.589Z

Reserved: 2026-09-11T19:38:34.735Z

Link: CVE-2026-89614

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:46.543

Modified: 2026-09-13T07:17:26.940

Link: CVE-2026-89614

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:14Z

Links: CVE-2026-89614 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T21:30:16Z

Weaknesses