CVE-2026-89781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89781", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.765Z", "datePublished": "2026-09-16T08:48:20.425Z", "dateUpdated": "2026-10-19T08:52:33.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:52:33.476Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix out-of-bounds read in read_log_rec_buf()\n\nread_log_rec_buf() copies a log record into a caller buffer starting at\n\n\tu32 off = lsn_to_page_off(log, lsn) + log->record_header_len;\n\nlog->record_header_len (and log->data_off, used for the following pages)\ncomes verbatim from the on-disk restart area and is only checked for\n8-byte alignment in is_rst_area_valid(), so off can exceed\nlog->page_size. \"tail = log->page_size - off\" then underflows and\nmemcpy() reads past the page_size-sized buffer returned by\nread_log_page(), spilling adjacent slab memory into the replay buffer.\n\nThis is reachable by mounting a crafted NTFS image:\n\n BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580\n Read of size 64 at addr ffff88800a877ff8 by task exploit/127\n read_log_rec_buf fs/ntfs3/fslog.c:2299\n log_replay fs/ntfs3/fslog.c:4216\n ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324\n ntfs_fill_super fs/ntfs3/super.c:1392\n get_tree_bdev_flags fs/super.c:1694\n __x64_sys_mount fs/namespace.c:4360\n The buggy address is located 4088 bytes to the right of\n the 4096-byte region [ffff88800a876000, ffff88800a877000)\n\nReject an in-page offset outside the current page before the copy.\n\n[almaz.alexandrovich@paragon-software.com: replaced the >= sign with >]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The OOB read is reached only while mounting a local NTFS volume (path_mount\u2192ntfs_fill_super\u2192ntfs_loadlog_and_replay\u2192log_replay\u2192read_rst_area/find_log_rec\u2192read_log_rec_buf). ksmbd/nfsd never parse $LogFile; journal replay runs at fill_super, not while serving exported files.\nAC:L - rec_hdr_len and data_off in the on-disk restart area are attacker-controlled and only checked for 8-byte alignment, so off=lsn_to_page_off()+record_header_len (and later data_off) can exceed page_size. The u32 tail underflow and memcpy past the kmalloc(page_size) log page are deterministic with no race.\nPR:N - No account or privilege on the victim is required: a crafted NTFS volume on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to run $LogFile replay as root.\nUI:N - Desktop, kiosk, automotive, and shared-workstation automounters mount attacker-supplied NTFS media and run log_replay() inside ntfs_fill_super() without the user opening files or confirming a dialog; attaching the crafted volume is sufficient.\nS:U - The slab out-of-bounds read occurs in the host kernel during ntfs3 journal replay in the mounting process; impact stays within one kernel security authority and is not a VM escape or IOMMU/DMA bypass.\nC:H - memcpy() copies attacker-chosen client_data_len bytes from past the page_size log-page slab into the replay buffer, spilling adjacent heap. client_data_len is only bounded by kmalloc success on the restart-area path, so this is an unbounded heap OOB read (Confidentiality High), not a few-byte leak.\nI:H - With a valid rec_hdr_len and oversized data_off, multi-page log records keep an attacker-controlled LOG_REC_HDR then fill the rest from adjacent slab (including same-size log pages from the crafted image). do_action then memmove()s that buffer into kmalloc'd MFT and index objects, yielding kernel writes from attacker-influenced heap contents.\nA:H - An oversized rec_hdr_len or data_off plus a large client_data_len drives memcpy() far past the 4KiB log-page allocation into unmapped slab or guard pages, causing a kernel oops or panic on mount. The crash is repeatable on every mount of the crafted NTFS volume."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/fslog.c"], "versions": [{"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "df099bfdb57773ba7f40f8a9dcc82e75af277922", "status": "affected", "versionType": "git"}, {"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "1b2d31f1083beb80c55d1152249f652c1445a559", "status": "affected", "versionType": "git"}, {"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "700973cc65db405bde0368ccf88699390150943e", "status": "affected", "versionType": "git"}, {"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "49f7cbc902b08b56eb7d2633163ecc57a0e7145a", "status": "affected", "versionType": "git"}, {"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "74a83aa05f73033af719771ab1f0c269928b4865", "status": "affected", "versionType": "git"}, {"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "53e56f7aa1d0f950a8bc2e4cdb3ba9fe45967531", "status": "affected", "versionType": "git"}, {"version": "b46acd6a6a627d876898e1c84d3f84902264b445", "lessThan": "de603b9d377fab57a5e6432fa84a9f36b32c1636", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/fslog.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/df099bfdb57773ba7f40f8a9dcc82e75af277922"}, {"url": "https://git.kernel.org/stable/c/1b2d31f1083beb80c55d1152249f652c1445a559"}, {"url": "https://git.kernel.org/stable/c/700973cc65db405bde0368ccf88699390150943e"}, {"url": "https://git.kernel.org/stable/c/49f7cbc902b08b56eb7d2633163ecc57a0e7145a"}, {"url": "https://git.kernel.org/stable/c/74a83aa05f73033af719771ab1f0c269928b4865"}, {"url": "https://git.kernel.org/stable/c/53e56f7aa1d0f950a8bc2e4cdb3ba9fe45967531"}, {"url": "https://git.kernel.org/stable/c/de603b9d377fab57a5e6432fa84a9f36b32c1636"}], "title": "fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/fslog.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "df099bfdb57773ba7f40f8a9dcc82e75af277922", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}, {"lessThan": "1b2d31f1083beb80c55d1152249f652c1445a559", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}, {"lessThan": "700973cc65db405bde0368ccf88699390150943e", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}, {"lessThan": "49f7cbc902b08b56eb7d2633163ecc57a0e7145a", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}, {"lessThan": "74a83aa05f73033af719771ab1f0c269928b4865", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}, {"lessThan": "53e56f7aa1d0f950a8bc2e4cdb3ba9fe45967531", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}, {"lessThan": "de603b9d377fab57a5e6432fa84a9f36b32c1636", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/fslog.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix out-of-bounds read in read_log_rec_buf()\n\nread_log_rec_buf() copies a log record into a caller buffer starting at\n\n\tu32 off = lsn_to_page_off(log, lsn) + log->record_header_len;\n\nlog->record_header_len (and log->data_off, used for the following pages)\ncomes verbatim from the on-disk restart area and is only checked for\n8-byte alignment in is_rst_area_valid(), so off can exceed\nlog->page_size. \"tail = log->page_size - off\" then underflows and\nmemcpy() reads past the page_size-sized buffer returned by\nread_log_page(), spilling adjacent slab memory into the replay buffer.\n\nThis is reachable by mounting a crafted NTFS image:\n\n BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580\n Read of size 64 at addr ffff88800a877ff8 by task exploit/127\n read_log_rec_buf fs/ntfs3/fslog.c:2299\n log_replay fs/ntfs3/fslog.c:4216\n ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324\n ntfs_fill_super fs/ntfs3/super.c:1392\n get_tree_bdev_flags fs/super.c:1694\n __x64_sys_mount fs/namespace.c:4360\n The buggy address is located 4088 bytes to the right of\n the 4096-byte region [ffff88800a876000, ffff88800a877000)\n\nReject an in-page offset outside the current page before the copy.\n\n[almaz.alexandrovich@paragon-software.com: replaced the >= sign with >]"}], "id": "CVE-2026-89781", "lastModified": "2026-10-19T09:18:21.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T09:17:08.667", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b2d31f1083beb80c55d1152249f652c1445a559"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49f7cbc902b08b56eb7d2633163ecc57a0e7145a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/53e56f7aa1d0f950a8bc2e4cdb3ba9fe45967531"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/700973cc65db405bde0368ccf88699390150943e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74a83aa05f73033af719771ab1f0c269928b4865"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de603b9d377fab57a5e6432fa84a9f36b32c1636"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df099bfdb57773ba7f40f8a9dcc82e75af277922"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,df099bfdb57773ba7f40f8a9dcc82e75af277922)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,1b2d31f1083beb80c55d1152249f652c1445a559)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,700973cc65db405bde0368ccf88699390150943e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,49f7cbc902b08b56eb7d2633163ecc57a0e7145a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,74a83aa05f73033af719771ab1f0c269928b4865)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,53e56f7aa1d0f950a8bc2e4cdb3ba9fe45967531)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b46acd6a6a627d876898e1c84d3f84902264b445,de603b9d377fab57a5e6432fa84a9f36b32c1636)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.221,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.188,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.157,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.110,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.52,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.6,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-16T13:30:10.618968+00:00", "updated": "2026-09-20T05:30:16.742790+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-200"]}