Linux Kernel up to 7.2.3 ntfs ntfs_attr_update_meta name_offset memory corruption

Summaryinfo

A vulnerability classified as very critical was found in Linux Kernel up to 7.2.3. This issue affects the function ntfs_attr_update_meta of the component ntfs. The manipulation of the argument name_offset results in memory corruption. This vulnerability is known as CVE-2026-89611. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2.3. Affected is the function ntfs_attr_update_meta of the component ntfs. The manipulation of the argument name_offset with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record. However, the validator does not check that name_offset is within safe boundaries for these operations or that the additional space is available. A malicious MFT record could set name_offset such that: 1. The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary. 2. The name overlaps with the mapping pairs, causing corruption during conversion. Add validation to ensure: - For named attributes, name_offset is within valid bounds - Name does not extend beyond the attribute or overlap with mapping pairs - For non-sparse, non-compressed attributes, eight bytes are available after mapping_pairs_offset for the compressed_size field The space check also covers unnamed attributes, for which name_offset = 0 is valid and no name range needs to be checked.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-89611 since 09/11/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation requires an enhanced level of successful authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/12/2026).

Upgrading to version 7.2.4 or 7.3-rc1 eliminates this vulnerability. Applying the patch cd7b3dc7557faadeea626034e3bac68a449851ef/a83e82b0ec3ae523028e24813f23f18b43e8fc1c is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion