CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

CVE-2026-89616 is an information disclosure vulnerability in the Linux kernel's NTFS3 filesystem driver. When ni_read_frame() decompresses an LZNT $DATA frame, decompress_lznt() may return fewer bytes than frame_size if the compressed stream is exhausted early. The unwritten tail region retains r...

EUVD-2026-76528

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89617 fs/ntfs3: validate dirty page table on log replay

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

CVE-2026-89617 fs/ntfs3: validate dirty page table on log replay

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

EUVD-2026-76527

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615 fs/ntfs3: bound page_lcns[] index by the log record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615 fs/ntfs3: bound page_lcns[] index by the log record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615

CVE-2026-89615 is a buffer overflow in the Linux kernel's NTFS3 filesystem driver. In the copy_lcns loop and the redo shorten loop, page_lcns[] is indexed at j + i, where i runs up to the log record's lcns_follow. That count is validated only against the record's own length, not the target entry'...

CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89613 ntfs: reject invalid empty mapping pairs

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89613 ntfs: reject invalid empty mapping pairs

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

EUVD-2026-76526

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

EUVD-2026-76525

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

CVE-2026-89614

CVE-2026-89614 affects the Linux kernel's NTFS file system driver . The flaw is in ntfs_cluster_alloc(), which bounds its free-cluster bitmap scan by the size of the on-disk $Bitmap rather than by the volume's actual cluster count (nr_clusters). Because these are independent quantities, a special...

CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...