CVE-2026-89613
UnknownSummary
In the Linux kernel, the ntfs driver does not reject attributes with empty mapping pairs if they have inconsistent highest VCN and size. The lack of validation can lead to incorrect processing.
Risk Assessment
An attacker can mount a crafted NTFS image with inconsistent attributes, potentially leading to kernel misbehavior or a crash.
Recommendation
Update the Linux kernel to a version containing the fix that rejects invalid empty mapping pairs.
Other vulnerabilities in Linux kernel (ntfs)
See all- CVE-2026-89614Unknown
In the Linux kernel, the ntfs driver bounds its free-cluster bitmap scan by the size of $Bitmap rather than the volume's cluster count. An image whose $Bitmap covers more clusters than the volume allows indexing past the lcn_empty_bits_per_page array.
- CVE-2026-89612Unknown
In the Linux kernel, parse_ntfs_boot_sector() decodes the NTFS boot sector's 64-bit LCNs into an s64. A crafted high-bit value becomes negative and passes the upper-bound check, leading to an out-of-bounds access to lcn_empty_bits_per_page.
- CVE-2026-89611Unknown
In the Linux kernel, ntfs_attr_update_meta() does not validate the attribute name offset when converting between non-sparse and sparse attributes. A malicious MFT record can set name_offset so the name extends beyond the attribute boundary or overlaps with mapping pairs.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size.