CVE-2026-89781: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix out-of-bounds read in readlogrecbuf()
readlogrecbuf() copies a log record into a caller buffer starting at
u32 off = lsntopageoff(log, lsn) + log->recordheaderlen;
log->recordheaderlen (and log->dataoff, used for the following pages) comes verbatim from the on-disk restart area and is only checked for 8-byte alignment in isrstareavalid(), so off can exceed log->pagesize. "tail = log->pagesize - off" then underflows and memcpy() reads past the pagesize-sized buffer returned by readlogpage(), spilling adjacent slab memory into the replay buffer.
This is reachable by mounting a crafted NTFS image:
BUG: KASAN: slab-out-of-bounds in readlogrecbuf+0x216/0x580 Read of size 64 at addr ffff88800a877ff8 by task exploit/127 readlogrecbuf fs/ntfs3/fslog.c:2299 logreplay fs/ntfs3/fslog.c:4216 ntfsloadlogandreplay fs/ntfs3/fsntfs.c:324 ntfsfillsuper fs/ntfs3/super.c:1392 gettreebdevflags fs/super.c:1694 x64sysmount fs/namespace.c:4360 The buggy address is located 4088 bytes to the right of the 4096-byte region [ffff88800a876000, ffff88800a877000)
Reject an in-page offset outside the current page before the copy.
[almaz.alexandrovich@paragon-software.com: replaced the >= sign with >]
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger this issue?
The attacker needs to provide a crafted NTFS image and have it mounted by the affected Linux kernel. The malformed on-disk restart area can supply a record header length that produces an invalid page offset during log replay.
Which environments are exposed?
Systems that mount attacker-controlled or otherwise untrusted NTFS images are exposed, because the issue is reachable during NTFS mount processing. The provided trace shows the vulnerable path runs through ntfs_loadlog_and_replay() and ntfs_fill_super().
What runtime evidence may indicate the issue has been triggered?
On a KASAN-enabled kernel, the issue can appear as a slab-out-of-bounds read in read_log_rec_buf() during mounting, with log_replay(), ntfs_loadlog_and_replay(), and ntfs_fill_super() in the call stack. The reported example reads beyond a 4096-byte buffer returned for a log page.