CVE-2026-89779 fs/ntfs3: validate ef->size covers the record's name and value
A local attacker can leak heap memory by mounting a crafted NTFS image, exploiting a missing size validation in the Linux kernel's NTFS3 driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89779?
CVE-2026-89779 is a critical vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength.
A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr():
BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94)
The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96
Compute the size the record needs and require ef->size to cover it.
Which versions are affected by CVE-2026-89779?
How do I fix CVE-2026-89779?
Apply the vendor's patch.
Is CVE-2026-89779 being exploited?
There is no known exploitation of CVE-2026-89779 in the wild and no public exploit code.
Sources
Also known as AZL-101265, BELL-CVE-2026-89779, DEBIAN-CVE-2026-89779, GHSA-gg5m-j9gf-rmhm, UBUNTU-CVE-2026-89779.