CVE-2026-89610

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

fs/ntfs registers ntfs_export_ops, so nfsd/ksmbd VFS reads and writes on an exported NTFS volume reach ntfs_map_runlist()->ntfs_mapping_pairs_decompress() and later use the over-long run via iomap and bitmap updates without local shell access.

AC:LAttack complexity, low

The attacker fully controls on-disk mapping pairs and can set a start LCN below nr_clusters with a length that extends past the volume or overflows s64; decompression and subsequent use of that run are deterministic with no race or victim-specific layout.

PR:NPrivileges required, none

Triggering the decoder needs only permission to cause server-side parsing of mounted NTFS metadata (guest/anonymous SMB or a permissive NFS export, or an unprivileged open/read on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.

UI:NUser interaction, none

After the crafted volume is mounted and exported, ordinary remote or local read/write/unlink operations decompress the poisoned mapping pairs and exercise the over-long run; no extra victim mount dialog, USB insertion, or confirmation is required during the attack.

S:UScope, unchanged

Heap corruption of vol->lcn_empty_bits_per_page and misdirected block I/O remain in the host kernel/OS security domain and do not cross a VM, container, or IOMMU boundary to another authority.

C:HConfidentiality impact, high

Over-long runs make ntfs_rl_vcn_to_lcn() return LCNs past nr_clusters, so iomap reads can disclose out-of-volume data, and ntfs_set_lcn_empty_bits() indexes lcn_empty_bits_per_page (sized only from nr_clusters), enabling kernel heap disclosure.

I:HIntegrity impact, high

The same run drives iomap writes past the volume and ntfs_bitmap_set_bits_in_run()/ntfs_set_lcn_empty_bits() past the allocated lcn_empty_bits_per_page array, a kernel heap OOB write and misdirected disk-write primitive consistent with the fix's memory-corruption and privilege-escalation impact.

A:HAvailability impact, high

Out-of-bounds bitmap/heap access, I/O past the block device, and huge-length bitmap walks can oops, panic, or hang the kernel, so even failed exploitation denies service to the host or exported filesystem.