CVE-2026-89615
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound page_lcns[] index by the log record
The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,
where i runs up to the log record's lcns_follow. That count is checked only against the record's own length, not the target entry, so check_dp_table() (which validates the entry's lcns_follow) does not cover it: the copy_lcns entry may even be freshly allocated after that check, and find_dp() bounds j but not i. A crafted record thus overflows page_lcns[] of an otherwise valid
entry.
Add dp_range_ok() and reject, before each loop, any record whose run does not fit the entry. These are the only two page_lcns[] accesses indexed by
the record rather than the entry, so together with the entry validation every access is now bounded.
[[email protected]: original patch contained changes to the problem already handled, applied partly]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel's NTFS3 filesystem driver contains a critical buffer overflow vulnerability within its transaction log processing logic, specifically involving the handling of directory entry records and their associated Log Sequence Numbers. This flaw arises from an improper boundary check during the copying of LCNS data into a fixed-size array named page_lcns. The vulnerability is rooted in the fact that while certain validation functions like find_dp() correctly bound one index variable j relative to the target entry, another loop iterating through log records uses an index calculated as j plus i, where i corresponds to lcns_follow from the incoming log record itself. Because this specific count derived from the external log record is only validated against the length of that record rather than the capacity or structure of the target directory entry, it creates a scenario where crafted input can exceed array bounds.
The operational impact of this vulnerability allows for potential out-of-bounds writes when processing maliciously constructed NTFS volume images or disk sectors containing specially formatted transaction logs. Since page_lcns is part of an otherwise valid data structure used during file system operations such as directory updates, overwriting adjacent memory could lead to kernel panic, privilege escalation if the overwritten memory contains function pointers or security-critical flags, or information disclosure depending on what lies beyond the array boundary in physical memory layout. The issue persists because earlier validation steps do not account for cumulative indices that depend directly on attacker-controlled fields within the log record rather than static properties of the destination entry.
This vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input, as it involves copying data into a buffer using an index derived from untrusted input without sufficient bounds checking relative to the target structure's limits. From a threat modeling perspective consistent with MITRE ATT&CK frameworks, this represents a technique often leveraged in exploitation chains involving local privilege escalation via kernel memory corruption, particularly when triggered through mounted file systems or removable media containing malicious NTFS partitions. The lack of proper validation before array access exemplifies classic input sanitization failures common in low-level system software handling complex binary formats like NTFS logs.
To mitigate this risk, the fix introduces a new function dp_range_ok() which validates that any record's run fits within the entry constraints prior to executing loops that index into page_lcns using record-dependent values. By rejecting records whose lcns_follow field would cause an overflow before entering either the copy_lcns loop or the redo shorten loop, all accesses to page_lcns are now strictly bounded by validated parameters derived from both the log record and the target entry structure. This ensures that even freshly allocated entries cannot be exploited via crafted LCNS counts embedded in transaction logs. System administrators should apply kernel updates incorporating this patch immediately for systems mounting untrusted NTFS volumes or processing external storage devices formatted with NTFS to prevent potential exploitation through maliciously prepared disk images or sector-level attacks targeting the filesystem driver's log replay mechanisms.