{"id":"CVE-2026-89616","title":"fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts de…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-908"],"vendor":"Linux","product":"Linux","affected":["Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 7d60a4c49af4d5cb88aa7cbf998d0408bd415055","Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < cd40eee4923d104ebec9ac7513b971bc441e431d","Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 77d8efd04745cda23858546afdbd9d07b591758e","Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea","Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 376ee45659a4b943df672ad275c63da00655f929","Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 4a1b39b2e10eb8de86265e80cf2be4396bc1dce4","Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd","Linux 5.15"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:48.800Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89616","references":[{"url":"https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055"},{"url":"https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d"},{"url":"https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e"},{"url":"https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"},{"url":"https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929"},{"url":"https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"},{"url":"https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89616.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89616"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532395"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89616"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89616"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89616.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00415,"epssPercentile":0.35649,"scores":{"cna":7.5,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89616","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()'s return value:\n\n  unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n                             frame_size);\n  if ((ssize_t)unc_size < 0)        err = unc_size;\n  else if (!unc_size || unc_size > frame_size)  err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file's\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero.\n\n## Affected\n\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 7d60a4c49af4d5cb88aa7cbf998d0408bd415055`\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < cd40eee4923d104ebec9ac7513b971bc441e431d`\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 77d8efd04745cda23858546afdbd9d07b591758e`\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea`\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 376ee45659a4b943df672ad275c63da00655f929`\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 4a1b39b2e10eb8de86265e80cf2be4396bc1dce4`\n- `Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 < 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89616.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":224661,"id":"CVE-2026-89616","ts":1792401465600,"field":"cvss","old":"5.5","new":"7.5"},{"seq":224660,"id":"CVE-2026-89616","ts":1792401465600,"field":"severity","old":"medium","new":"high"},{"seq":208083,"id":"CVE-2026-89616","ts":1789922706478,"field":"cvss","old":"7.5","new":"5.5"},{"seq":208082,"id":"CVE-2026-89616","ts":1789922706478,"field":"severity","old":"high","new":"medium"},{"seq":197843,"id":"CVE-2026-89616","ts":1789384320643,"field":"cvss","old":"5.5","new":"7.5"},{"seq":197842,"id":"CVE-2026-89616","ts":1789384320643,"field":"severity","old":"medium","new":"high"},{"seq":183400,"id":"CVE-2026-89616","ts":1789356675210,"field":"cvss","old":"7.5","new":"5.5"},{"seq":183399,"id":"CVE-2026-89616","ts":1789356675210,"field":"severity","old":"high","new":"medium"},{"seq":153450,"id":"CVE-2026-89616","ts":1789285350560,"field":"cvss","old":null,"new":"7.5"},{"seq":153449,"id":"CVE-2026-89616","ts":1789285350560,"field":"severity","old":"none","new":"high"},{"seq":147279,"id":"CVE-2026-89616","ts":1789270206562,"field":"cvss","old":null,"new":"5.5"},{"seq":147278,"id":"CVE-2026-89616","ts":1789270206562,"field":"severity","old":"none","new":"medium"},{"seq":109032,"id":"CVE-2026-89616","ts":1789183730037,"field":"cvss","old":null,"new":"5.5"},{"seq":109031,"id":"CVE-2026-89616","ts":1789183730037,"field":"severity","old":"none","new":"medium"}]}