GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89614 (GCVE-0-2026-89614)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:31
VLAI
Title
ntfs: bound the free-cluster bitmap scan to the volume
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the array. A run whose LCN lies in that gap takes the allocator straight there, since the caller passes the file's own last LCN as its locality hint. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. Clamp the scan to what that array covers, mirroring the max_index calculation the mount-time scan already uses, and reject a decoded LCN at or beyond nr_clusters in the mapping pairs decoder. Conforming volumes are unaffected.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 11ccc9107dc460de28af90fac1f42404d9802735 , < dc15a9f5307d5372aef3b64bf3ed7802f530c471 (git)
Affected: 11ccc9107dc460de28af90fac1f42404d9802735 , < 19cac7902a8ab748e15f98ddaafcf5f8882be21d (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/lcnalloc.c",
            "fs/ntfs/runlist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc15a9f5307d5372aef3b64bf3ed7802f530c471",
              "status": "affected",
              "version": "11ccc9107dc460de28af90fac1f42404d9802735",
              "versionType": "git"
            },
            {
              "lessThan": "19cac7902a8ab748e15f98ddaafcf5f8882be21d",
              "status": "affected",
              "version": "11ccc9107dc460de28af90fac1f42404d9802735",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/lcnalloc.c",
            "fs/ntfs/runlist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the free-cluster bitmap scan to the volume\n\nvol-\u003elcn_empty_bits_per_page is sized from vol-\u003enr_clusters at mount, but\nntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.\nThose are independent on-disk quantities and the mount-time check only\nrejects a $Bitmap that is too small, so an image whose $Bitmap covers more\nclusters than the volume has lets the scan index past the array.  A run\nwhose LCN lies in that gap takes the allocator straight there, since the\ncaller passes the file\u0027s own last LCN as its locality hint.  KASAN reports\na slab out-of-bounds read when a file on such a volume is extended.\n\nClamp the scan to what that array covers, mirroring the max_index\ncalculation the mount-time scan already uses, and reject a decoded LCN\nat or beyond nr_clusters in the mapping pairs decoder.  Conforming\nvolumes are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fs/ntfs registers ntfs_export_ops, so nfsd/ksmbd VFS writes on an exported NTFS volume reach ntfs_file_write_iter-\u003eiomap-\u003entfs_attr_expand-\u003entfs_cluster_alloc, and reads reach ntfs_mapping_pairs_decompress, without local shell access.\nAC:L - A crafted image whose $Bitmap covers more clusters than nr_clusters, plus a file run whose LCN sits in that gap, deterministically drives the allocator to index past lcn_empty_bits_per_page and the decoder to accept out-of-volume LCNs, with no race or victim-specific layout.\nPR:N - Triggering needs only permission to cause server-side parse or extend of mounted NTFS metadata (guest/anonymous SMB, a permissive NFS export, or an unprivileged local open/write on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.\nUI:N - After the crafted volume is mounted and optionally exported, ordinary remote or local write/truncate/fallocate, and reads that decompress mapping pairs, trigger the bug; no extra victim mount dialog, USB insertion, or confirmation is required during the attack.\nS:U - Slab out-of-bounds access to vol-\u003elcn_empty_bits_per_page and misdirected block I/O remain in the host kernel/OS security domain and do not cross a VM, container, or IOMMU boundary to another authority.\nC:H - ntfs_cluster_alloc performs a KASAN-confirmed slab out-of-bounds read of lcn_empty_bits_per_page at an attacker-influenced page index, and decoded LCNs past nr_clusters make iomap reads disclose data beyond the NTFS volume, a kernel heap/OOB-read disclosure primitive.\nI:H - With zone_end set from the poisoned LCN, the bitmap scan calls ntfs_set_lcn_empty_bits() on out-of-range indices (heap OOB write of empty-bit counts) and iomap can write past the volume using those LCNs, a kernel memory-corruption primitive consistent with privilege escalation.\nA:H - KASAN reports a slab out-of-bounds access when a file on such a volume is extended; indexing past the kvmalloc array can oops, and the OOB write of lcn_empty_bits_per_page can panic or hang the host, so even failed exploitation denies service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:52.589Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471"
        },
        {
          "url": "https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d"
        }
      ],
      "title": "ntfs: bound the free-cluster bitmap scan to the volume",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89614",
    "datePublished": "2026-09-11T19:45:14.747Z",
    "dateReserved": "2026-09-11T19:38:34.735Z",
    "dateUpdated": "2026-09-13T06:31:52.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89614",
      "date": "2026-09-16",
      "epss": "0.00407",
      "percentile": "0.34483"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89614\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:46.543\",\"lastModified\":\"2026-09-13T07:17:26.940\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs: bound the free-cluster bitmap scan to the volume\\n\\nvol-\u003elcn_empty_bits_per_page is sized from vol-\u003enr_clusters at mount, but\\nntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.\\nThose are independent on-disk quantities and the mount-time check only\\nrejects a $Bitmap that is too small, so an image whose $Bitmap covers more\\nclusters than the volume has lets the scan index past the array.  A run\\nwhose LCN lies in that gap takes the allocator straight there, since the\\ncaller passes the file\u0027s own last LCN as its locality hint.  KASAN reports\\na slab out-of-bounds read when a file on such a volume is extended.\\n\\nClamp the scan to what that array covers, mirroring the max_index\\ncalculation the mount-time scan already uses, and reject a decoded LCN\\nat or beyond nr_clusters in the mapping pairs decoder.  Conforming\\nvolumes are unaffected.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs/lcnalloc.c\",\"fs/ntfs/runlist.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"11ccc9107dc460de28af90fac1f42404d9802735\",\"lessThan\":\"dc15a9f5307d5372aef3b64bf3ed7802f530c471\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"11ccc9107dc460de28af90fac1f42404d9802735\",\"lessThan\":\"19cac7902a8ab748e15f98ddaafcf5f8882be21d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs/lcnalloc.c\",\"fs/ntfs/runlist.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T10:28:48+00:00",
      "cve": "CVE-2026-89614",
      "id": "CVE-2026-89614",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: bound the free-cluster bitmap scan to the volume",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89614.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-09-13T16:58:02Z",
      "cve": "CVE-2026-89614",
      "id": "CVE-2026-89614",
      "initial_release_date": "2026-09-12T16:25:02Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89614",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89614.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.