CVE-2026-89779: fs/ntfs3: validate ef->size covers the record's name and value
fs/ntfs3: validate ef->size covers the record's name and value
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs to provide a crafted NTFS image containing an extended-attribute record whose declared record size is too small for its name and value, while its value length is large. The vulnerable path is reached when the NTFS3 driver processes that record and a user retrieves the extended attribute through getxattr().
What is the security impact of successful exploitation?
The driver can copy data beyond its allocated extended-attribute buffer and expose kernel heap memory to userspace. The reported failure is a slab out-of-bounds read in ntfs_get_ea(), with a copy size controlled by the malformed record's value length.
How can administrators determine whether their systems may be affected?
Systems using the Linux kernel NTFS3 filesystem driver may be exposed when they process untrusted or attacker-controlled NTFS images and allow extended attributes to be read. The provided data does not identify affected kernel versions; compare the kernel source or vendor update information against the referenced stable fixes.
What mitigation is available if the fix cannot be deployed immediately?
Avoid mounting or processing untrusted NTFS images with the NTFS3 driver, particularly where untrusted users can cause extended attributes to be read. Restrict access to removable media, disk images, and other attacker-controlled NTFS filesystem content.