CVE-2026-89616 in Linux
Summary
by MITRE • 09/12/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress_lznt()'s return value:
unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem, frame_size); if ((ssize_t)unc_size < 0) err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL;
decompress_lznt() stops as soon as the compressed stream is exhausted (e.g. a zero chunk header) and returns the number of bytes it actually wrote, which may be far less than frame_size. The bytes between unc_size and frame_size are never written. The only memset() that follows zeroes the region beyond i_valid; when the frame lies entirely within the file's valid size that memset() does not run, so the gap retains whatever was in the just-vmapped pages. All pages are then marked uptodate and returned to userspace, disclosing uninitialized (recently-freed) kernel page memory. A crafted compressed file whose stream decompresses to only a few bytes leaks the remainder of every frame on a plain read(2), which is enough to recover kernel pointers and defeat KASLR.
Zero the [unc_size, frame_size) tail immediately after a successful LZNT
decompress so the remainder reads back as zero.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The Linux kernel vulnerability identified in the NTFS3 filesystem driver involves an information leak resulting from improper handling of partial decompression within the ni_read_frame function. This flaw allows for the disclosure of uninitialized kernel memory to user space, which can be exploited by a local attacker with read access to crafted compressed files. The core issue stems from how the system manages memory allocation and initialization during the LZNT compression algorithm's execution phase. When reading an NTFS file that utilizes LZNT compression, the kernel allocates virtual memory pages to hold the decompressed data. These pages are mapped into the process address space but may contain residual data from previous allocations if they were recently freed or reused by other kernel operations.
The technical flaw occurs specifically within the ni_read_frame routine where the system invokes decompress_lznt to expand the compressed stream. This function processes the input buffer and writes the resulting uncompressed bytes into the target memory region defined by frame_size. However, decompress_lznt is designed to stop processing as soon as it encounters a zero chunk header or when the compressed source data is exhausted. Consequently, the return value unc_size reflects only the actual number of bytes successfully written during this specific operation. In scenarios where the compressed stream yields significantly fewer output bytes than the allocated frame size, there remains an unwritten gap between unc_size and frame_size. The code logic subsequently checks if the decompression was successful or returned a valid error code but fails to verify whether the entire target buffer has been initialized with deterministic data.
A critical aspect of this vulnerability is the conditional execution of memory zeroing operations that follow the decompression step. The kernel attempts to clear any remaining uninitialized data using a memset operation, but this action is gated by a check against i_valid, which represents the valid file size range. If the current frame lies entirely within the bounds of the file's declared valid size, the condition for executing the memset is not met because the logic assumes that only bytes beyond the valid end need clearing to prevent leaks during partial reads at the tail of a file. As a result, when the decompressed data occupies less space than the allocated buffer and falls completely within the valid range, the gap between the actual output size and the frame boundary remains untouched. This leaves uninitialized kernel memory exposed in the user-accessible page frames.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and security bypass through information disclosure. By reading a specially crafted compressed NTFS file that triggers partial decompression, an attacker can cause the kernel to return pages containing stale data from recently freed objects or other sensitive structures in memory. This leakage provides raw material for analyzing kernel layout, enabling the recovery of kernel pointers such as function addresses and global variable locations. With these pointers exposed, attackers can defeat Kernel Address Space Layout Randomization KASLR, a fundamental defense mechanism that randomizes kernel code and data positions to prevent exploitation of other vulnerabilities. Furthermore, leaking arbitrary kernel memory may reveal credentials, encryption keys, or internal state information critical for further system compromise.
From an industry standards perspective, this vulnerability aligns with CWE-200 Information Exposure where sensitive information is disclosed without proper authorization or sanitization. It also relates closely to CWE-457 Use of Uninitialized Variable as the memory region between unc_size and frame_size retains its previous state rather than being explicitly initialized before exposure. In terms of attack vectors, this falls under ATT&CK technique T1083 File and Directory Discovery combined with T1005 Data from Local System if used to gather intelligence for lateral movement or deeper exploitation. The root cause is a logic error in boundary checking that fails to ensure complete buffer initialization prior to user-space exposure.
To mitigate this vulnerability, the primary remediation involves modifying the ni_read_frame function to explicitly zero out any portion of the decompressed frame that was not written by the LZNT decompressor. Specifically, after calling decompress_lznt and confirming a successful operation where unc_size is greater than zero but less than or equal to frame_size, the system must execute a memset operation on the range from unc_size up to frame_size regardless of whether those bytes fall within i_valid. This ensures that all user-accessible memory derived from kernel allocations contains deterministic zeros rather than potentially sensitive residual data. Additionally, developers should review similar decompression routines in other filesystem drivers like FAT or exFAT for analogous patterns where partial writes might leave gaps uninitialized before mapping pages to userspace. Regular auditing of buffer handling logic during compression and decompression operations is essential to prevent future instances of this class of memory safety issues.