{"id":"CVE-2026-89617","title":"fs/ntfs3: validate dirty page table on log replay","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate dirty page table on log replay\n\nEach DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk\nlcns_follow field. check_rstbl() validate…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 0e07ea2fc45a7b4757ef7bf1f692cc0180a08323","Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 1e90b1703ee1a04cd3e9e399353fc536f5f3ba10","Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < d23155634a4bc1183e761d5eb2c043b2e693cc98","Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 1200c2779c43b62656ccbb67df9468a7a9af2484","Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 2d94ffc9d7b5bb3517b129fe63b52d84bcd4ae56","Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 0908da07c23be4f94b99dfd9a94765525f0fe4bd","Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 006cb7713dec10368e699abc4367e5faa334c9a5","Linux 5.15"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:49.792Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89617","references":[{"url":"https://git.kernel.org/stable/c/0e07ea2fc45a7b4757ef7bf1f692cc0180a08323"},{"url":"https://git.kernel.org/stable/c/1e90b1703ee1a04cd3e9e399353fc536f5f3ba10"},{"url":"https://git.kernel.org/stable/c/d23155634a4bc1183e761d5eb2c043b2e693cc98"},{"url":"https://git.kernel.org/stable/c/1200c2779c43b62656ccbb67df9468a7a9af2484"},{"url":"https://git.kernel.org/stable/c/2d94ffc9d7b5bb3517b129fe63b52d84bcd4ae56"},{"url":"https://git.kernel.org/stable/c/0908da07c23be4f94b99dfd9a94765525f0fe4bd"},{"url":"https://git.kernel.org/stable/c/006cb7713dec10368e699abc4367e5faa334c9a5"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89617.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89617"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532222"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89617"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89617"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89617.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00139,"epssPercentile":0.03214,"scores":{"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89617","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate dirty page table on log replay\n\nEach DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk\nlcns_follow field. check_rstbl() validates the table bookkeeping but never\nchecks that this array fits in the entry, so a crafted lcns_follow lets the\nv0->v1 conversion memmove and later replay passes run off the entry.\n\nAdd check_dp_table() to reject, right after check_rstbl(), any entry larger\nthan its size claims via struct_size() (the same expression used to allocate\nthese entries, so the check is overflow-safe by construction). All consumers\ncan then trust lcns_follow as the real capacity. This covers every\npage_lcns[] access whose index is bounded by the entry itself (the\nconversion memmove, the HotFix store via find_dp(), and the self-bounded\nscan loops). Accesses whose index comes from the log record need a separate\nbound and are handled in a follow-up patch.\n\n## Affected\n\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 0e07ea2fc45a7b4757ef7bf1f692cc0180a08323`\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 1e90b1703ee1a04cd3e9e399353fc536f5f3ba10`\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < d23155634a4bc1183e761d5eb2c043b2e693cc98`\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 1200c2779c43b62656ccbb67df9468a7a9af2484`\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 2d94ffc9d7b5bb3517b129fe63b52d84bcd4ae56`\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 0908da07c23be4f94b99dfd9a94765525f0fe4bd`\n- `Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 006cb7713dec10368e699abc4367e5faa334c9a5`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89617.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224659,"id":"CVE-2026-89617","ts":1792401465160,"field":"cvss","old":"5.5","new":"7.8"},{"seq":224658,"id":"CVE-2026-89617","ts":1792401465160,"field":"severity","old":"medium","new":"high"},{"seq":208072,"id":"CVE-2026-89617","ts":1789922704577,"field":"cvss","old":"7.8","new":"5.5"},{"seq":208071,"id":"CVE-2026-89617","ts":1789922704577,"field":"severity","old":"high","new":"medium"},{"seq":197845,"id":"CVE-2026-89617","ts":1789384320651,"field":"cvss","old":"6.4","new":"7.8"},{"seq":197844,"id":"CVE-2026-89617","ts":1789384320651,"field":"severity","old":"medium","new":"high"},{"seq":183731,"id":"CVE-2026-89617","ts":1789356677141,"field":"cvss","old":"7.8","new":"6.4"},{"seq":183730,"id":"CVE-2026-89617","ts":1789356677141,"field":"severity","old":"high","new":"medium"},{"seq":153452,"id":"CVE-2026-89617","ts":1789285350568,"field":"cvss","old":null,"new":"7.8"},{"seq":153451,"id":"CVE-2026-89617","ts":1789285350568,"field":"severity","old":"none","new":"high"},{"seq":147594,"id":"CVE-2026-89617","ts":1789270211524,"field":"cvss","old":null,"new":"6.4"},{"seq":147593,"id":"CVE-2026-89617","ts":1789270211524,"field":"severity","old":"none","new":"medium"},{"seq":109346,"id":"CVE-2026-89617","ts":1789183731543,"field":"cvss","old":null,"new":"6.4"},{"seq":109345,"id":"CVE-2026-89617","ts":1789183731543,"field":"severity","old":"none","new":"medium"}]}