Look up another CVE · open CVE-2026-89615 in the interactive tracker
CVE-2026-89615
fs/ntfs3: bound page_lcns[] index by the log record
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/ntfs3. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89615 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i, where i runs up to the log record's lcns_follow. That count is checked only against the record's own length, not the target entry, so check_dp_table() (which validates the entry's lcns_follow) does not cover it: the copy_lcns entry may even be freshly allocated after that check, and find_dp() bounds j but not i. A crafted record thus overflows page_lcns[] of an otherwise valid entry. Add dp_range_ok() and reject, before each loop, any record whose run does not fit the entry. These are the only two page_lcns[] accesses indexed by the record rather than the entry, so together with the entry validation every access is now bounded. [almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ntfs3/fslog.c
- What this is
- NTFS3 FILESYSTEMMAINTAINERS section matched on fs/ntfs3/ · ntfs3@lists.linux.dev · Supported
- Kernel module
- ntfs3
Check it on the machine
grep -w CONFIG_NTFS3_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ntfs3Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 3 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.
- bookwormn
- trixiem
- forky, sidn
- bookworm · linux-6.12m
- n
- not enabled on any flavour - this release does not build the code
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_NTFS3_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.15%, higher than 3.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/ntfs3
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 5.15.221 | 31fdd11f75da |
| 5.15 | 6.1.188 | bb742d103086 |
| 5.15 | 6.6.157 | 61ca8cbbf68f |
| 5.15 | 6.12.109 | f4c1bc6d7331 |
| 5.15 | 6.18.50 | 7ccb94901f38 |
| 5.15 | 7.2.4 | 1135ebc22599 |
| 5.15 | 7.3 | 6f7b9dbdc1b7 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The page_lcns[] overflow is reached only in log_replay() on the local ntfs3 mount path (path_mount→ntfs_fill_super→ntfs_loadlog_and_replay→log_replay). ksmbd/nfsd never parse $LogFile; journal replay runs at fill_super, not while serving exported files.
- AC:LAttack complexity, low
- An attacker fully controls crafted $LogFile LOG_REC_HDR fields (target_vcn, lcns_follow) and the target DIR_PAGE_ENTRY. find_dp() only bounds the base index j; the redo shorten loop then indexes page_lcns[j+i-1] with i up to the record's lcns_follow, so the OOB access is deterministic with no race.
- PR:NPrivileges required, none
- No account or privilege on the victim is required: a crafted NTFS volume on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to run $LogFile replay as root.
- UI:NUser interaction, none
- Desktop, kiosk, and shared-workstation automounters mount attacker-supplied NTFS media and run log_replay() inside ntfs_fill_super() without the user opening files or confirming a dialog; attaching the crafted volume is sufficient to trigger the overflow.
- S:UScope, unchanged
- Heap out-of-bounds page_lcns[] access occurs in the host kernel during ntfs3 journal replay in the mounting process; impact stays within one kernel security authority and is not a VM escape or IOMMU/DMA bypass.
- C:HConfidentiality impact, high
- The redo shorten loop reads dp->page_lcns[j+i-1] with i taken from the log record's lcns_follow (u16, up to 65535 entries / ~512KB past the DIR_PAGE_ENTRY). That unbounded slab out-of-bounds read of adjacent heap is Confidentiality High per kernel OOB-read guidance.
- I:HIntegrity impact, high
- On unfixed kernels the copy_lcns analysis loop wrote attacker-controlled __le64 values past page_lcns[], a heap OOB write. Independently, OOB page_lcns[] reads in the redo pass control dlen passed to do_action() memcpy/memmove into MFT and index buffers, enabling further kernel writes.
- A:HAvailability impact, high
- Indexing far past the kmalloc-backed DIR_PAGE_ENTRY in log_replay() on mount can fault unmapped adjacent slab memory, causing a kernel oops or panic. The crash is repeatable on every mount of the crafted NTFS volume.