CVE-2026-89612: ntfs: reject invalid MFT LCNs from boot sector
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject invalid MFT LCNs from boot sector
The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector() decoded them into an s64.
A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcnemptybitsperpage.
Affected Software
Event History
Frequently Asked Questions
What attacker-controlled input is required to trigger the flaw?
An attacker needs to provide an NTFS boot sector with a high-bit value in the MFT or MFTMirr location field. The unsigned 64-bit LCN can be decoded as a negative signed value and bypass the existing upper-bound check.
What is the resulting failure condition?
The invalid LCN can propagate into the MFT zone allocator and lead to an out-of-bounds access to lcn_empty_bits_per_page.