CVE-2026-89616

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89616", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.735Z", "datePublished": "2026-09-11T19:45:16.064Z", "dateUpdated": "2026-10-19T08:49:48.800Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:49:48.800Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()'s return value:\n\n unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n frame_size);\n if ((ssize_t)unc_size < 0) err = unc_size;\n else if (!unc_size || unc_size > frame_size) err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file's\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - ni_read_frame() runs from ntfs_read_folio on LZNT-compressed reads. ntfs3 registers export_operations, so ksmbd/nfsd vfs_read and splice on an exported NTFS volume reach this path and return leaked page-cache bytes to a remote SMB/NFS client on NAS and hybrid file-server deployments.\nAC:L - A crafted NTFS image fully controls the on-disk LZNT stream; a zero chunk header makes decompress_lznt() return far fewer than frame_size bytes deterministically, with no race, rare config, or attacker-uncontrollable memory layout required.\nPR:N - A remote client can trigger the leak by reading a world-readable compressed file over NFS (AUTH_SYS/guest) or a ksmbd guest share with no local account or capability on the host; ntfs3 file-read paths check only inode state, not privileges.\nUI:N - After the NTFS volume is mounted and exported\u2014the normal state for NAS, dual-boot, and automounted removable NTFS\u2014the attacker only issues reads; no further victim action such as opening a file or confirming a prompt is required.\nS:U - The leak exposes the host kernel's own freed page contents through that kernel's page cache to the reader and does not cross a VM, guest-to-host, IOMMU, or other security-authority boundary.\nC:H - Each crafted frame can disclose up to the uncompressed LZNT unit (typically 64KiB) of uninitialized recently-freed kernel page memory, repeatable across the file, including kernel pointers for KASLR bypass and residual secrets rather than a small bounded read.\nI:N - The defect only leaves the decompressed-frame tail unzeroed in the file's own page-cache pages; it does not perform an out-of-bounds write, corrupt kernel objects, or yield a write or control-flow hijack primitive.\nA:N - Partial LZNT decompress is treated as success; pages are marked uptodate and the read returns data without a kernel oops, panic, hang, deadlock, or other availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/frecord.c"], "versions": [{"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "7d60a4c49af4d5cb88aa7cbf998d0408bd415055", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "cd40eee4923d104ebec9ac7513b971bc441e431d", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "77d8efd04745cda23858546afdbd9d07b591758e", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "376ee45659a4b943df672ad275c63da00655f929", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "4a1b39b2e10eb8de86265e80cf2be4396bc1dce4", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/frecord.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055"}, {"url": "https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d"}, {"url": "https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e"}, {"url": "https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"}, {"url": "https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929"}, {"url": "https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"}, {"url": "https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"}], "title": "fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/frecord.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7d60a4c49af4d5cb88aa7cbf998d0408bd415055", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "cd40eee4923d104ebec9ac7513b971bc441e431d", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "77d8efd04745cda23858546afdbd9d07b591758e", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "376ee45659a4b943df672ad275c63da00655f929", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "4a1b39b2e10eb8de86265e80cf2be4396bc1dce4", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/frecord.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()'s return value:\n\n unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n frame_size);\n if ((ssize_t)unc_size < 0) err = unc_size;\n else if (!unc_size || unc_size > frame_size) err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file's\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero."}], "id": "CVE-2026-89616", "lastModified": "2026-10-19T09:17:58.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:46.783", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Information leak in NTFS3 filesystem due to partial LZNT decompression", "id": "2532395", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532395"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the `ni_read_frame()` function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially crafted compressed file. Successful exploitation could allow an attacker to obtain sensitive kernel pointers, potentially bypassing Kernel Address Space Layout Randomization (KASLR) and aiding further attacks."], "name": "CVE-2026-89616", "public_date": "2026-09-11T19:45:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89616\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89616\nhttps://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea\nhttps://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd\nhttps://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929\nhttps://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4342306f0f0d5ff4315a204d315c1b51b914fca5,0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4342306f0f0d5ff4315a204d315c1b51b914fca5,376ee45659a4b943df672ad275c63da00655f929)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4342306f0f0d5ff4315a204d315c1b51b914fca5,4a1b39b2e10eb8de86265e80cf2be4396bc1dce4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4342306f0f0d5ff4315a204d315c1b51b914fca5,35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T07:45:10.711717+00:00", "updated": "2026-09-15T21:30:16.428110+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}