CVE-2026-89782

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access occurs in the NTFS3 file system during $LogFile replay. The log replay() function indexes the transaction table using a transact id from the log record header. Because check log rec() does not verify the magnitude of this ID, a crafted NTFS image can request an excessively large index. When alloc rsttbl from idx() attempts to grow the table via extend rsttbl(), the new entry count is passed to init rsttbl(). A type mismatch occurs where a u32 value is passed to a function expecting a u16, causing the value to be truncated if it exceeds U16 MAX. This results in the allocation of a table smaller than required, leading to an out-of-bounds write when alloc rsttbl from idx() uses the original untruncated offset. This issue is triggered by mounting a specially crafted NTFS image and involves the alloc rsttbl from idx() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.