{"id":"CVE-2026-89614","revision":"d6c7530fa42c405c8184f755143ac820","records":[{"revision":"d6c7530fa42c405c8184f755143ac820","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89614","aliases":[],"title":"ntfs: bound the free-cluster bitmap scan to the volume","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the free-cluster bitmap scan to the volume\n\nvol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but\nntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.\nThose are independent on-disk quantities and the mount-time check only\nrejects a $Bitmap that is too small, so an image whose $Bitmap covers more\nclusters than the volume has lets the scan index past the array.  A run\nwhose LCN lies in that gap takes the allocator straight there, since the\ncaller passes the file's own last LCN as its locality hint.  KASAN reports\na slab out-of-bounds read when a file on such a volume is extended.\n\nClamp the scan to what that array covers, mirroring the max_index\ncalculation the mount-time scan already uses, and reject a decoded LCN\nat or beyond nr_clusters in the mapping pairs decoder.  Conforming\nvolumes are unaffected.","state":0,"publishedAt":"2026-09-11T19:45:14.747+00:00","modifiedAt":"2026-10-19T08:49:46.853+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ntfs/lcnalloc.c\",\n                        \"fs/ntfs/runlist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"11ccc9107dc460de28af90fac1f42404d9802735\",\n                            \"lessThan\": \"dc15a9f5307d5372aef3b64bf3ed7802f530c471\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"11ccc9107dc460de28af90fac1f42404d9802735\",\n                            \"lessThan\": \"19cac7902a8ab748e15f98ddaafcf5f8882be21d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ntfs/lcnalloc.c\",\n                        \"fs/ntfs/runlist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471","https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89614","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89614","identifiers":["CVE-2026-89614"]},"retained":false,"historicalAffected":[]}],"coverage":[]}