CVE-2026-89782: fs/ntfs3: reject restart table growth beyond U16_MAX entries
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: reject restart table growth beyond U16MAX entries
During $LogFile replay, logreplay() indexes the transaction table by the transactid taken from the log record header. checklogrec() only verifies that transactid is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily large index.
allocrsttblfromidx() grows the table to cover that index via extendrsttbl(), which passes the new entry count to initrsttbl():
rt = initrsttbl(esize, used + add);
used + add is computed as u32 but initrsttbl() takes a u16, and the count is stored in struct RESTARTTABLE as a le16. When used + add exceeds U16MAX it is truncated, initrsttbl() allocates a table far smaller than the index requires, and allocrsttblfromidx() then dereferences and writes at the original, untruncated offset -- an out-of-bounds access past the allocation, reachable by mounting a crafted NTFS image.
BUG: KASAN: use-after-free in allocrsttblfromidx (fs/ntfs3/fslog.c:950) Read of size 4 at addr ffff8880327ffff8 by task exploit allocrsttblfromidx (fs/ntfs3/fslog.c:950) logreplay (fs/ntfs3/fslog.c:4562) ntfsloadlogandreplay (fs/ntfs3/fsntfs.c:324) ntfsfillsuper (fs/ntfs3/super.c:1393) gettreebdevflags vfsgettree pathmount x64sysmount
A restart table is limited to U16MAX entries by its le16 count, so a larger growth request is invalid input. Reject it in extendrsttbl(); all callers already handle a NULL return.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify ntfs3 restart table handling to reject restart table growth requests that exceed U16_MAX entries (implemented as “fs/ntfs3: reject restart table growth beyond U16_MAX entries”).
Linux kernel (fs/ntfs3) extend_rsttbl() restart table growth beyond U16_MAX entries = reject
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that mount NTFS images using the Linux kernel's ntfs3 filesystem driver are exposed when they process a maliciously crafted image containing a $LogFile that triggers replay.
What does an attacker need to exploit it?
An attacker needs to provide a crafted NTFS image and have it mounted so that $LogFile replay occurs. The vulnerable path is reached through an oversized transaction ID in a log record.
What happens during exploitation?
The restart-table entry count can truncate after exceeding U16_MAX, causing allocation of a table smaller than required. The driver then accesses the original larger offset, resulting in an out-of-bounds access reported as a use-after-free by KASAN.