CVE-2026-89779: fs/ntfs3: validate ef->size covers the record's name and value
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfsreadea() only checks that the record fits in the remaining buffer (easize > bytes), not that ef->size is large enough to hold the record's own namelen + 1 + elength.
A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfsgetea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr():
BUG: KASAN: slab-out-of-bounds in ntfsgetea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit asanmemcpy (mm/kasan/shadow.c:105) ntfsgetea (fs/ntfs3/xattr.c:302) ntfsgetxattr (fs/ntfs3/xattr.c:848) vfsgetxattr (fs/xattr.c:441) vfsgetxattr (fs/xattr.c:474) dogetxattr (fs/xattr.c:800) pathgetxattrat (fs/xattr.c:868) dosyscall64 (arch/x86/entry/syscall64.c:94)
The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96
Compute the size the record needs and require ef->size to cover it.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs to provide a crafted NTFS image containing an extended-attribute record whose declared record size is too small for its name and value, while its value length is large. The vulnerable path is reached when the NTFS3 driver processes that record and a user retrieves the extended attribute through getxattr().
What is the security impact of successful exploitation?
The driver can copy data beyond its allocated extended-attribute buffer and expose kernel heap memory to userspace. The reported failure is a slab out-of-bounds read in ntfs_get_ea(), with a copy size controlled by the malformed record's value length.
How can administrators determine whether their systems may be affected?
Systems using the Linux kernel NTFS3 filesystem driver may be exposed when they process untrusted or attacker-controlled NTFS images and allow extended attributes to be read. The provided data does not identify affected kernel versions; compare the kernel source or vendor update information against the referenced stable fixes.
What mitigation is available if the fix cannot be deployed immediately?
Avoid mounting or processing untrusted NTFS images with the NTFS3 driver, particularly where untrusted users can cause extended attributes to be read. Restrict access to removable media, disk images, and other attacker-controlled NTFS filesystem content.