PT-2026-90327 · Linux · Linux
CVE-2026-89611
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate non-resident attribute offsets
ntfs attr update meta() shifts the attribute name when converting between
non-sparse and sparse attributes. Converting to sparse also adds the
compressed size field before the name and mapping pairs, requiring eight
additional bytes in the attribute record.
However, the validator does not check that name offset is within safe
boundaries for these operations or that the additional space is available.
A malicious MFT record could set name offset such that:
-
The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary.
-
The name overlaps with the mapping pairs, causing corruption during conversion.
Add validation to ensure:
- For named attributes, name offset is within valid bounds
- Name does not extend beyond the attribute or overlap with mapping pairs
- For non-sparse, non-compressed attributes, eight bytes are available after mapping pairs offset for the compressed size field
The space check also covers unnamed attributes, for which name offset = 0
is valid and no name range needs to be checked.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux