CVE-2026-89779 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength.
A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr():
BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94)
The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96
Compute the size the record needs and require ef->size to cover it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's NTFS3 filesystem driver contains a critical validation flaw within its extended attribute handling logic, specifically in the ntfs_read_ea function located in fs/ntfs3/xattr.c. This vulnerability arises from an insufficient boundary check when processing Extended Attribute (EA) records. The code correctly verifies that the total size of the EA record fits within the remaining buffer space by comparing ea_size against bytes. However, it fails to validate whether ef->size is sufficiently large to encompass the internal structure of the attribute itself, which includes the name length and value length fields. This oversight creates a scenario where a crafted NTFS image can present an EF record with a small declared size while containing significantly larger embedded values, effectively bypassing the initial safety checks designed to prevent buffer overflows or out-of-bounds reads.
The operational impact of this flaw is severe, leading to heap memory disclosure through a kernel-to-userspace information leak. When ntfs_get_ea processes such a malformed record, it trusts the elength field without verifying its consistency against ef->size. Consequently, the function proceeds to copy data based on the inflated length value, causing a read operation that extends far beyond the allocated kmalloc region. As evidenced by kernel address sanitizer reports, this results in reading past the end of an 84-byte allocation within the kmalloc-96 cache. The excess data is then returned to userspace via the getxattr system call interface, allowing local attackers with access to the vulnerable filesystem mount point to read arbitrary heap memory contents from the kernel space.
This vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this flaw facilitates information disclosure and can be leveraged as part of an exploitation chain under ATT&CK technique T1083, File and Directory Discovery, although its primary classification remains a memory safety violation that compromises kernel integrity by exposing sensitive internal state to unprivileged processes. The lack of strict validation on the relationship between record size fields allows for predictable heap layout manipulation or data exfiltration depending on what resides in the adjacent memory regions.
To mitigate this risk, developers must enforce stricter validation logic within ntfs_read_ea and related functions. Specifically, the code should compute the expected minimum size required to hold the attribute's name and value components and ensure that ef->size is greater than or equal to this calculated requirement before proceeding with any data extraction operations. This ensures that internal consistency checks are performed alongside external buffer boundary checks. System administrators relying on NTFS3 mounts for critical workloads should apply kernel updates that include these patches immediately, as the vulnerability allows local privilege escalation vectors if combined with other exploitation techniques and poses a direct risk to system confidentiality through heap leakage.