CVE-2026-89782 - Vulnerability Details

- fs/ntfs3: reject restart table growth beyond U16_MAX entries

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject restart table growth beyond U16_MAX entries

During $LogFile replay, log_replay() indexes the transaction table by the
transact_id taken from the log record header. check_log_rec() only
verifies that transact_id is non-zero and properly aligned, not its
magnitude, so a crafted image can request an arbitrarily large index.

alloc_rsttbl_from_idx() grows the table to cover that index via
extend_rsttbl(), which passes the new entry count to init_rsttbl():

rt = init_rsttbl(esize, used + add);

used + add is computed as u32 but init_rsttbl() takes a u16, and the
count is stored in struct RESTART_TABLE as a __le16. When used + add
exceeds U16_MAX it is truncated, init_rsttbl() allocates a table far
smaller than the index requires, and alloc_rsttbl_from_idx() then
dereferences and writes at the original, untruncated offset -- an
out-of-bounds access past the allocation, reachable by mounting a
crafted NTFS image.

BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950)
Read of size 4 at addr ffff8880327ffff8 by task exploit
alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950)
log_replay (fs/ntfs3/fslog.c:4562)
ntfs_loadlog_and_replay (fs/ntfs3/fsntfs.c:324)
ntfs_fill_super (fs/ntfs3/super.c:1393)
get_tree_bdev_flags
vfs_get_tree
path_mount
__x64_sys_mount

A restart table is limited to U16_MAX entries by its __le16 count, so a
larger growth request is invalid input. Reject it in extend_rsttbl();
all callers already handle a NULL return.

Published: 2026-09-16

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel NTFS3 module contains a fault where the restart table count is truncated from a 32‑bit value to a 16‑bit field. A crafted NTFS image can request a table growth far larger than U16_MAX, causing the allocation to be far smaller than needed and the subsequent code to write past the end of the buffer. This out‑of‑bounds write leads to a use‑after‑free and kernel memory corruption, enabling an attacker who can mount the image to potentially execute arbitrary code with kernel privileges.

Affected Systems

All Linux kernel builds that include the ff ntfs3 filesystem driver are affected. The issue originates in the ntfs3 module code that handles NTFS log replay during mount time.

Risk and Exploitability

The vulnerability requires a local attacker that can mount a malicious NTFS volume. It is not listed in CISA KEV and no EPSS score is reported. Once mounted, the out‑of‑bounds write can overwrite kernel data and give the attacker the same privileges as the kernel process, leading to full privilege escalation. The severity is high thanks to the kernel memory corruption and the broad impact on system integrity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 339e59996ff193adcf1c438cf05f19e753beb3a7
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< ecde45cd81dc28f5696c312c5ce5a509962e9ab1
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< be218a01aadffe33ed4fc73e25276d676ebbd09d
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< aad605a450611e2a7b7cf9dd5724004d39192bfb
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 967a5ff8a614d10126b6d46db1ac040948d6cb42
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 111f8d74a19d85942ecbb3aba78f6f3c88e59391

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b46acd6a6a627d876898e1c84d3f84902264b445,caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,339e59996ff193adcf1c438cf05f19e753beb3a7)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,ecde45cd81dc28f5696c312c5ce5a509962e9ab1)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,be218a01aadffe33ed4fc73e25276d676ebbd09d)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,aad605a450611e2a7b7cf9dd5724004d39192bfb)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,967a5ff8a614d10126b6d46db1ac040948d6cb42)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,111f8d74a19d85942ecbb3aba78f6f3c88e59391)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a revision that includes the fixed commit to the NTFS3 driver.
If an update is not immediately available, avoid mounting any untrusted NTFS volumes; use read‑only mounts or disable the ntfs3 module entirely for now.
Monitor kernel logs for KASAN messages that indicate exploitation attempts and apply any vendor‑released patches promptly.

Generated by OpenCVE AI on September 16, 2026 at 14:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00205.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/111f8d74a19d85942ecbb3aba78f6f3c88e59391
https://git.kernel.org/stable/c/339e59996ff193adcf1c438cf05f19e753beb3a7
https://git.kernel.org/stable/c/967a5ff8a614d10126b6d46db1ac040948d6cb42
https://git.kernel.org/stable/c/aad605a450611e2a7b7cf9dd5724004d39192bfb
https://git.kernel.org/stable/c/be218a01aadffe33ed4fc73e25276d676ebbd09d
https://git.kernel.org/stable/c/caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56
https://git.kernel.org/stable/c/ecde45cd81dc28f5696c312c5ce5a509962e9ab1

History

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190 CWE-787
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_rec() only verifies that transact_id is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily large index. alloc_rsttbl_from_idx() grows the table to cover that index via extend_rsttbl(), which passes the new entry count to init_rsttbl(): rt = init_rsttbl(esize, used + add); used + add is computed as u32 but init_rsttbl() takes a u16, and the count is stored in struct RESTART_TABLE as a __le16. When used + add exceeds U16_MAX it is truncated, init_rsttbl() allocates a table far smaller than the index requires, and alloc_rsttbl_from_idx() then dereferences and writes at the original, untruncated offset -- an out-of-bounds access past the allocation, reachable by mounting a crafted NTFS image. BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) Read of size 4 at addr ffff8880327ffff8 by task exploit alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) log_replay (fs/ntfs3/fslog.c:4562) ntfs_loadlog_and_replay (fs/ntfs3/fsntfs.c:324) ntfs_fill_super (fs/ntfs3/super.c:1393) get_tree_bdev_flags vfs_get_tree path_mount __x64_sys_mount A restart table is limited to U16_MAX entries by its __le16 count, so a larger growth request is invalid input. Reject it in extend_rsttbl(); all callers already handle a NULL return.
Title		fs/ntfs3: reject restart table growth beyond U16_MAX entries
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/111f8d74a19d85942ecbb3aba78f6f3c88e59391 https://git.kernel.org/stable/c/339e59996ff193adcf1c438cf05f19e753beb3a7 https://git.kernel.org/stable/c/967a5ff8a614d10126b6d46db1ac040948d6cb42 https://git.kernel.org/stable/c/aad605a450611e2a7b7cf9dd5724004d39192bfb https://git.kernel.org/stable/c/be218a01aadffe33ed4fc73e25276d676ebbd09d https://git.kernel.org/stable/c/caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56 https://git.kernel.org/stable/c/ecde45cd81dc28f5696c312c5ce5a509962e9ab1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:21.093Z

Updated: 2026-09-16T14:38:33.748Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89782

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.800

Modified: 2026-09-16T15:18:08.577

Link: CVE-2026-89782

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-16T14:30:10Z

Weaknesses

CWE-190
Integer Overflow or Wraparound
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object