CVE-2026-89611 ntfs: validate non-resident attribute offsets
A malicious MFT record can trigger out-of-bounds writes in the Linux kernel NTFS driver, potentially allowing local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89611?
CVE-2026-89611 is a critical memory corruption vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate non-resident attribute offsets
ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record.
However, the validator does not check that name_offset is within safe boundaries for these operations or that the additional space is available. A malicious MFT record could set name_offset such that:
1. The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary.
2. The name overlaps with the mapping pairs, causing corruption during conversion.
Add validation to ensure: - For named attributes, name_offset is within valid bounds - Name does not extend beyond the attribute or overlap with mapping pairs - For non-sparse, non-compressed attributes, eight bytes are available after mapping_pairs_offset for the compressed_size field
The space check also covers unnamed attributes, for which name_offset = 0 is valid and no name range needs to be checked.
Which versions are affected by CVE-2026-89611?
How do I fix CVE-2026-89611?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89611 being exploited?
There is no known exploitation of CVE-2026-89611 in the wild and no public exploit code.
Sources
Also known as AZL-100067, BELL-CVE-2026-89611, DEBIAN-CVE-2026-89611, GHSA-h6x4-53v9-p3rg, UBUNTU-CVE-2026-89611.