CVE-2026-89785

CVE CVE-2026-89785EUVD EUVD-2026-80306Published 2026-09-16T08:48:23.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init ntfs_reparse_init() and ntfs_objid_init() parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles (the INDEX_ROOT attributes named $R and $O). They read its type and rule fields through resident_data(), which does not check that the resident attribute is large enough to hold them. mi_enum_attr() accepts a resident attribute with data_off == asize and data_size == 0. For such an attribute placed last in its MFT record, resident_data() returns a pointer to the end of the record_size buffer, so reading root->type / root->rule reads past the allocation. Use resident_data_ex(attr, sizeof(struct INDEX_ROOT)) and bail out when it returns NULL, as ntfs_security_init() already does for $SDH / $SII. The attribute is only parsed while mounting a crafted image, so this needs CAP_SYS_ADMIN. BUG: KASAN: slab-out-of-bounds in ntfs_reparse_init (fs/ntfs3/fsntfs.c:2306) Read of size 4 at addr ffff88801219dc00 by task mount ntfs_reparse_init (fs/ntfs3/fsntfs.c:2306) ntfs_fill_super (fs/ntfs3/super.c:1604) get_tree_bdev_flags (fs/super.c:1703) vfs_get_tree (fs/super.c:1758) path_mount (fs/namespace.c:4131) __x64_sys_mount (fs/namespace.c:4360)

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 7.3-rc1; patch: 6.6.157; 82cae269cfa953032fbb8980a7d554d60fb00b17 <94fce1d3e74fe011e21f17490ba58491709fd7e5; patch: 6.12.110; 82cae269cfa953032fbb8980a7d554d60fb00b17 <64bb6000bfbdf241a6dd578199acd90321a4243e; 82cae269cfa953032fbb8980a7d554d60fb00b17 <72caafbc95c5dca8266a942b8e96ad81d8d9adc7; 82cae269cfa953032fbb8980a7d554d60fb00b17 <66c074eab6f966fbe48a0fc4b3a45b2a2e2df527; 82cae269cfa953032fbb8980a7d554d60fb00b17 <2064bc663f89e61b8681c1fb9d1ce445de72063d; patch: 7.2.6; patch: 6.18.52; patch: 0; 82cae269cfa953032fbb8980a7d554d60fb00b17 <eb80003744e32a7366a523015e4acfe0a2ac7d88; 82cae269cfa953032fbb8980a7d554d60fb00b17 <bd631e2005290a55c8edda87363bc0d594c01705; patch: 6.1.188; 5.15; patch: 5.15.221

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.