{"id":"CVE-2026-89611","title":"ntfs: validate non-resident attribute offsets","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate non-resident attribute offsets\n\nntfs_attr_update_meta() shifts the attribute name when converting between\nnon-sparse and sparse attributes. Converting to…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cd7b3dc7557faadeea626034e3bac68a449851ef","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a83e82b0ec3ae523028e24813f23f18b43e8fc1c","Linux < 7.2.4","Linux (all versions)"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:43.569Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89611","references":[{"url":"https://git.kernel.org/stable/c/cd7b3dc7557faadeea626034e3bac68a449851ef"},{"url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89611.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89611"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532167"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89611"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89611"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89611.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00553,"epssPercentile":0.46017,"scores":{"cna":9.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.474Z","slug":"CVE-2026-89611","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate non-resident attribute offsets\n\nntfs_attr_update_meta() shifts the attribute name when converting between\nnon-sparse and sparse attributes. Converting to sparse also adds the\ncompressed_size field before the name and mapping pairs, requiring eight\nadditional bytes in the attribute record.\n\nHowever, the validator does not check that name_offset is within safe\nboundaries for these operations or that the additional space is available.\nA malicious MFT record could set name_offset such that:\n\n1. The name is positioned at the very end of a non-sparse attribute.\n   Converting to sparse would shift the name forward by 8 bytes,\n   writing beyond the attribute boundary.\n\n2. The name overlaps with the mapping pairs, causing corruption during\n   conversion.\n\nAdd validation to ensure:\n- For named attributes, name_offset is within valid bounds\n- Name does not extend beyond the attribute or overlap with mapping pairs\n- For non-sparse, non-compressed attributes, eight bytes are available\n  after mapping_pairs_offset for the compressed_size field\n\nThe space check also covers unnamed attributes, for which name_offset = 0\nis valid and no name range needs to be checked.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cd7b3dc7557faadeea626034e3bac68a449851ef`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a83e82b0ec3ae523028e24813f23f18b43e8fc1c`\n- `Linux < 7.2.4`\n- `Linux (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89611.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":224669,"id":"CVE-2026-89611","ts":1792401467328,"field":"cvss","old":"5.5","new":"9.8"},{"seq":224668,"id":"CVE-2026-89611","ts":1792401467328,"field":"severity","old":"medium","new":"critical"},{"seq":208077,"id":"CVE-2026-89611","ts":1789922705539,"field":"cvss","old":"5.7","new":"5.5"},{"seq":202859,"id":"CVE-2026-89611","ts":1789403732699,"field":"cvss","old":"9.8","new":"5.7"},{"seq":202858,"id":"CVE-2026-89611","ts":1789403732699,"field":"severity","old":"critical","new":"medium"},{"seq":197853,"id":"CVE-2026-89611","ts":1789384320681,"field":"cvss","old":"5.7","new":"9.8"},{"seq":197852,"id":"CVE-2026-89611","ts":1789384320681,"field":"severity","old":"medium","new":"critical"},{"seq":183410,"id":"CVE-2026-89611","ts":1789356675252,"field":"cvss","old":"9.8","new":"5.7"},{"seq":183409,"id":"CVE-2026-89611","ts":1789356675252,"field":"severity","old":"critical","new":"medium"},{"seq":153440,"id":"CVE-2026-89611","ts":1789285350521,"field":"cvss","old":null,"new":"9.8"},{"seq":153439,"id":"CVE-2026-89611","ts":1789285350521,"field":"severity","old":"none","new":"critical"},{"seq":147642,"id":"CVE-2026-89611","ts":1789270211708,"field":"cvss","old":null,"new":"5.7"},{"seq":147641,"id":"CVE-2026-89611","ts":1789270211708,"field":"severity","old":"none","new":"medium"},{"seq":109396,"id":"CVE-2026-89611","ts":1789183731753,"field":"cvss","old":null,"new":"5.7"},{"seq":109395,"id":"CVE-2026-89611","ts":1789183731753,"field":"severity","old":"none","new":"medium"}]}