CVE-2026-89779 - fs/ntfs3: validate ef->size covers the record's name and value

Back Back to CVE browser

CRITICAL

fs/ntfs3: validate ef->size covers the record's name and value

Published Sep 16, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.70%

Description

When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength.

A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr():

BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94)

The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96

Compute the size the record needs and require ef->size to cover it.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
unaffected
- Version
  5.15.121
  Status
  affected
  Constraints
  <5.15.221
- Version
  6.1.40
  Status
  affected
  Constraints
  <6.1.188
Vendor Linux Product Linux Default
affected
- Version
  6.2
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.2
- Version
  5.15.221
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.188
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.12.110
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.52
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.6.157
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  7.2.6
  Status
  unaffected
  Constraints
  <=7.2.*
- Version
  7.3-rc1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

unaffected

Version	Status	Constraints
5.15.121	affected	<5.15.221
6.1.40	affected	<6.1.188

Linux

affected

Version	Status	Constraints
6.2	affected	-
0	unaffected	<6.2
5.15.221	unaffected	<=5.15.*
6.1.188	unaffected	<=6.1.*
6.12.110	unaffected	<=6.12.*
6.18.52	unaffected	<=6.18.*
6.6.157	unaffected	<=6.6.*
7.2.6	unaffected	<=7.2.*
7.3-rc1	unaffected	<=*

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (8)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80300		Advisory
https://git.kernel.org/stable/c/077df8464cf24f8ffc82fb6efec2ae600686e699
https://git.kernel.org/stable/c/28a924c7e67e6d71abeb04860b61166fecb027fc
https://git.kernel.org/stable/c/aab1880058ac767d3ea9388a9a7221c776c22c44
https://git.kernel.org/stable/c/b27e68ad818a4ca2cef8f35f97e75d756714c818
https://git.kernel.org/stable/c/c22f91d82cb9a29d22bdffdce6c803467984ad0c
https://git.kernel.org/stable/c/c8a109c9e23a2c7fd548473dde728b2cb8188146
https://git.kernel.org/stable/c/d585ed08308909c7e6fefb4e8a258aeb29b19ff9