CVE-2026-89782

CVE CVE-2026-89782EUVD EUVD-2026-80303Published 2026-09-16T08:48:21.000ZLast changed 2026-09-16T14:38:33.000ZCVSS 8.4

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_rec() only verifies that transact_id is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily large index. alloc_rsttbl_from_idx() grows the table to cover that index via extend_rsttbl(), which passes the new entry count to init_rsttbl(): rt = init_rsttbl(esize, used + add); used + add is computed as u32 but init_rsttbl() takes a u16, and the count is stored in struct RESTART_TABLE as a __le16. When used + add exceeds U16_MAX it is truncated, init_rsttbl() allocates a table far smaller than the index requires, and alloc_rsttbl_from_idx() then dereferences and writes at the original, untruncated offset -- an out-of-bounds access past the allocation, reachable by mounting a crafted NTFS image. BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) Read of size 4 at addr ffff8880327ffff8 by task exploit alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) log_replay (fs/ntfs3/fslog.c:4562) ntfs_loadlog_and_replay (fs/ntfs3/fsntfs.c:324) ntfs_fill_super (fs/ntfs3/super.c:1393) get_tree_bdev_flags vfs_get_tree path_mount __x64_sys_mount A restart table is limited to U16_MAX entries by its __le16 count, so a larger growth request is invalid input. Reject it in extend_rsttbl(); all callers already handle a NULL return.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux b46acd6a6a627d876898e1c84d3f84902264b445 <ecde45cd81dc28f5696c312c5ce5a509962e9ab1; b46acd6a6a627d876898e1c84d3f84902264b445 <aad605a450611e2a7b7cf9dd5724004d39192bfb; patch: 0; patch: 6.6.157; b46acd6a6a627d876898e1c84d3f84902264b445 <be218a01aadffe33ed4fc73e25276d676ebbd09d; b46acd6a6a627d876898e1c84d3f84902264b445 <339e59996ff193adcf1c438cf05f19e753beb3a7; patch: 6.12.110; b46acd6a6a627d876898e1c84d3f84902264b445 <caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56; b46acd6a6a627d876898e1c84d3f84902264b445 <967a5ff8a614d10126b6d46db1ac040948d6cb42; patch: 5.15.221; patch: 7.3-rc1; 5.15; patch: 6.1.188; patch: 6.18.52; patch: 7.2.6; b46acd6a6a627d876898e1c84d3f84902264b445 <111f8d74a19d85942ecbb3aba78f6f3c88e59391

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.