CVE-2026-89614

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

fs/ntfs registers ntfs_export_ops, so nfsd/ksmbd VFS writes on an exported NTFS volume reach ntfs_file_write_iter->iomap->ntfs_attr_expand->ntfs_cluster_alloc, and reads reach ntfs_mapping_pairs_decompress, without local shell access.

AC:LAttack complexity, low

A crafted image whose $Bitmap covers more clusters than nr_clusters, plus a file run whose LCN sits in that gap, deterministically drives the allocator to index past lcn_empty_bits_per_page and the decoder to accept out-of-volume LCNs, with no race or victim-specific layout.

PR:NPrivileges required, none

Triggering needs only permission to cause server-side parse or extend of mounted NTFS metadata (guest/anonymous SMB, a permissive NFS export, or an unprivileged local open/write on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.

UI:NUser interaction, none

After the crafted volume is mounted and optionally exported, ordinary remote or local write/truncate/fallocate, and reads that decompress mapping pairs, trigger the bug; no extra victim mount dialog, USB insertion, or confirmation is required during the attack.

S:UScope, unchanged

Slab out-of-bounds access to vol->lcn_empty_bits_per_page and misdirected block I/O remain in the host kernel/OS security domain and do not cross a VM, container, or IOMMU boundary to another authority.

C:HConfidentiality impact, high

ntfs_cluster_alloc performs a KASAN-confirmed slab out-of-bounds read of lcn_empty_bits_per_page at an attacker-influenced page index, and decoded LCNs past nr_clusters make iomap reads disclose data beyond the NTFS volume, a kernel heap/OOB-read disclosure primitive.

I:HIntegrity impact, high

With zone_end set from the poisoned LCN, the bitmap scan calls ntfs_set_lcn_empty_bits() on out-of-range indices (heap OOB write of empty-bit counts) and iomap can write past the volume using those LCNs, a kernel memory-corruption primitive consistent with privilege escalation.

A:HAvailability impact, high

KASAN reports a slab out-of-bounds access when a file on such a volume is extended; indexing past the kvmalloc array can oops, and the OOB write of lcn_empty_bits_per_page can panic or hang the host, so even failed exploitation denies service.