GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-89779

Vulnerability from fkie_nvd - Published: 2026-09-16 09:17 - Updated: 2026-09-16 09:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength. A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr(): BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94) The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96 Compute the size the record needs and require ef->size to cover it.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/077df8464cf24f8ffc82fb6efec2ae600686e699
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28a924c7e67e6d71abeb04860b61166fecb027fc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aab1880058ac767d3ea9388a9a7221c776c22c44
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b27e68ad818a4ca2cef8f35f97e75d756714c818
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c22f91d82cb9a29d22bdffdce6c803467984ad0c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c8a109c9e23a2c7fd548473dde728b2cb8188146
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d585ed08308909c7e6fefb4e8a258aeb29b19ff9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b27e68ad818a4ca2cef8f35f97e75d756714c818",
              "status": "affected",
              "version": "333feb7ba84f69f9b423422417aaac54fd9e7c84",
              "versionType": "git"
            },
            {
              "lessThan": "28a924c7e67e6d71abeb04860b61166fecb027fc",
              "status": "affected",
              "version": "000a9a72efa4a9df289bab9c9e8ba1639c72e0d6",
              "versionType": "git"
            },
            {
              "lessThan": "d585ed08308909c7e6fefb4e8a258aeb29b19ff9",
              "status": "affected",
              "version": "0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b",
              "versionType": "git"
            },
            {
              "lessThan": "077df8464cf24f8ffc82fb6efec2ae600686e699",
              "status": "affected",
              "version": "0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b",
              "versionType": "git"
            },
            {
              "lessThan": "aab1880058ac767d3ea9388a9a7221c776c22c44",
              "status": "affected",
              "version": "0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b",
              "versionType": "git"
            },
            {
              "lessThan": "c8a109c9e23a2c7fd548473dde728b2cb8188146",
              "status": "affected",
              "version": "0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b",
              "versionType": "git"
            },
            {
              "lessThan": "c22f91d82cb9a29d22bdffdce6c803467984ad0c",
              "status": "affected",
              "version": "0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.40",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate ef-\u003esize covers the record\u0027s name and value\n\nWhen an EA record has a non-zero ef-\u003esize, ntfs_read_ea() only checks\nthat the record fits in the remaining buffer (ea_size \u003e bytes), not that\nef-\u003esize is large enough to hold the record\u0027s own name_len + 1 + elength.\n\nA crafted image can pass validation with, e.g., ef-\u003esize = 24 but\nelength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of\nthe undersized record, reading past the kmalloc(info-\u003esize) allocation\nand leaking heap memory to userspace via getxattr():\n\n BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302)\n Read of size 65535 at addr ffff888100794550 by task exploit\n  __asan_memcpy (mm/kasan/shadow.c:105)\n  ntfs_get_ea (fs/ntfs3/xattr.c:302)\n  ntfs_getxattr (fs/ntfs3/xattr.c:848)\n  __vfs_getxattr (fs/xattr.c:441)\n  vfs_getxattr (fs/xattr.c:474)\n  do_getxattr (fs/xattr.c:800)\n  path_getxattrat (fs/xattr.c:868)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n\n The buggy address is located 80 bytes inside of\n  allocated 84-byte region in cache kmalloc-96\n\nCompute the size the record needs and require ef-\u003esize to cover it."
    }
  ],
  "id": "CVE-2026-89779",
  "lastModified": "2026-09-16T09:17:08.387",
  "metrics": {},
  "published": "2026-09-16T09:17:08.387",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/077df8464cf24f8ffc82fb6efec2ae600686e699"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/28a924c7e67e6d71abeb04860b61166fecb027fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aab1880058ac767d3ea9388a9a7221c776c22c44"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b27e68ad818a4ca2cef8f35f97e75d756714c818"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c22f91d82cb9a29d22bdffdce6c803467984ad0c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c8a109c9e23a2c7fd548473dde728b2cb8188146"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d585ed08308909c7e6fefb4e8a258aeb29b19ff9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.