Bug 2532418 (CVE-2026-89610)

Summary:	CVE-2026-89610 kernel: ntfs: verify run length exceeding volume boundary
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and potentially allow for privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-11 22:54:41 UTC

In the Linux kernel, the following vulnerability has been resolved:

ntfs: verify run length exceeding volume boundary

The mapping pairs decoder validates that the starting LCN is within the
volume but does not check if the run extends beyond the volume boundary.

A malformed NTFS image with a crafted mapping pairs array could cause
the kernel to access memory beyond the volume boundary, potentially leading
to memory corruption and privilege escalation.

Add validation to ensure lcn + length stays within nr_clusters.

Comment 1 gkamathe 2026-09-15 09:29:14 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89610.mbox