CVE-2026-89613 (GCVE-0-2026-89613)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:31
VLAI
Title
ntfs: reject invalid empty mapping pairs
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 11ccc9107dc460de28af90fac1f42404d9802735 , < b0cc6dbc655e037251874b3e0dd1a760dcf29007 (git)
Affected: 11ccc9107dc460de28af90fac1f42404d9802735 , < 766062a82e1ce4087c7dc077224144dfd34b3661 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/runlist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0cc6dbc655e037251874b3e0dd1a760dcf29007",
              "status": "affected",
              "version": "11ccc9107dc460de28af90fac1f42404d9802735",
              "versionType": "git"
            },
            {
              "lessThan": "766062a82e1ce4087c7dc077224144dfd34b3661",
              "status": "affected",
              "version": "11ccc9107dc460de28af90fac1f42404d9802735",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/runlist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: reject invalid empty mapping pairs\n\nReject an attribute with empty mapping pairs if it has inconsistent\nhighest VCN and size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fs/ntfs registers ntfs_export_ops, so nfsd/ksmbd VFS reads on an exported NTFS volume reach ntfs_map_runlist()-\u003entfs_mapping_pairs_decompress() for crafted on-disk mapping pairs without local shell access.\nAC:L - The attacker fully controls the empty mapping-pairs terminator, lowest/highest VCN, and allocated/data/initialized sizes; decompressing that attribute and merging the resulting degenerate runlist is deterministic with no race or victim-specific layout.\nPR:N - Triggering the decoder needs only permission to cause server-side parsing of mounted NTFS metadata (guest/anonymous SMB or a permissive NFS export, or an unprivileged open/read on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.\nUI:N - After the crafted volume is mounted and exported, ordinary remote or local reads decompress the invalid empty mapping pairs and enter the merge path; no extra victim mount dialog, USB insertion, or confirmation is required during the attack.\nS:U - Heap corruption of the in-memory runlist and subsequent misdirected cluster I/O remain in the host kernel security domain and do not cross a VM, container, or IOMMU boundary to another authority.\nC:H - Merging the degenerate unmapped runlist computes a negative source size and indexes src+ssize-1 / dst[marker] outside the allocation, an unbounded kernel heap out-of-bounds read that can disclose adjacent objects.\nI:H - The same merge performs out-of-bounds runlist writes via marker/loc arithmetic with ssize\u003c0 and later I/O using corrupted VCN/LCN mappings, a kernel heap write primitive sufficient for control-flow hijacking.\nA:H - WARN_ON on an entirely unmapped source runlist, heap out-of-bounds access, and corrupted runlist walks oops or panic the kernel, fully denying availability even when exploitation is not completed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:51.266Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0cc6dbc655e037251874b3e0dd1a760dcf29007"
        },
        {
          "url": "https://git.kernel.org/stable/c/766062a82e1ce4087c7dc077224144dfd34b3661"
        }
      ],
      "title": "ntfs: reject invalid empty mapping pairs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89613",
    "datePublished": "2026-09-11T19:45:14.081Z",
    "dateReserved": "2026-09-11T19:38:34.735Z",
    "dateUpdated": "2026-09-13T06:31:51.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89613",
      "date": "2026-09-21",
      "epss": "0.00553",
      "percentile": "0.4483"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/runlist.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b0cc6dbc655e037251874b3e0dd1a760dcf29007",
                    "status": "affected",
                    "version": "11ccc9107dc460de28af90fac1f42404d9802735",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "766062a82e1ce4087c7dc077224144dfd34b3661",
                    "status": "affected",
                    "version": "11ccc9107dc460de28af90fac1f42404d9802735",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/runlist.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: reject invalid empty mapping pairs\n\nReject an attribute with empty mapping pairs if it has inconsistent\nhighest VCN and size."
          }
        ],
        "id": "CVE-2026-89613",
        "lastModified": "2026-09-13T07:17:26.840",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:46.433",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/766062a82e1ce4087c7dc077224144dfd34b3661"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b0cc6dbc655e037251874b3e0dd1a760dcf29007"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T11:02:18+00:00",
      "cve": "CVE-2026-89613",
      "id": "CVE-2026-89613",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: reject invalid empty mapping pairs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89613.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:37:37Z",
      "cve": "CVE-2026-89613",
      "id": "CVE-2026-89613",
      "initial_release_date": "2026-09-12T16:25:04Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89613",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89613.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.