Memory Leak Vulnerability in Linux Kernel's NTFS3 Filesystem Handling

CVE-2026-89779

What is CVE-2026-89779?

A vulnerability exists in the Linux kernel's NTFS3 filesystem handling, where insufficient validation of extended attribute (EA) records can be exploited. When an EA record specifies a non-zero size, the kernel only verifies that the size fits within the buffer, neglecting to ensure that the size is adequate to hold the entire record, including its name and value lengths. This oversight allows attackers to craft a malicious image that can bypass safeguards. Upon exploitation, it results in an out-of-bounds memory read, enabling sensitive data leakage from the heap memory to userspace. This vulnerability highlights the critical importance of thorough validation in file system operations.

References