CVE-2026-89613

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number VCN and size. A local attacker could potentially craft a malicious NTFS filesystem that,...

CVE-2026-89611

A flaw was found in the Linux kernel. The NTFS file system driver does not properly validate non-resident attribute offsets when converting between sparse and non-sparse attributes. A local attacker could craft a malicious Master File Table MFT record, which could lead to writing data beyond...

DEBIAN-CVE-2026-89613

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89613

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

AZL-100067 CVE-2026-89611 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

UBUNTU-CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89610

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

UBUNTU-CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

EUVD-2026-76525

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

CVE-2026-89612

CVE-2026-89612 is a vulnerability in the Linux kernel's NTFS filesystem driver . The function parse_ntfs_boot_sector() decoded MFT and MFTMirr Logical Cluster Numbers (LCNs) from the NTFS boot sector into a signed 64-bit integer (s64), even though they are stored as unsigned 64-bit values. A craf...

CVE-2026-89611 ntfs: validate non-resident attribute offsets

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89611

This vulnerability affects the Linux kernel NTFS driver in ntfs_attr_update_meta(), where insufficient validation of non-resident attribute offsets during sparse/non-sparse conversion allows a malicious MFT record to cause out-of-bounds writes or data overlap with mapping pairs. Red Hat describes...

CVE-2026-89610 ntfs: verify run length exceeding volume boundary

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

PT-2026-90329

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

PT-2026-90328

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse ntfs boot sector decoded them into an s64. A crafted high-bit value could therefore becom...

PT-2026-90330

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcn empty bits per page is sized from vol-nr clusters at mount, but ntfs cluster alloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...

CVE-2026-80673

A flaw was found in the Linux kernel's NTFS file system driver. An attacker can craft a malicious on-disk attribute list that, when processed, causes an out-of-bounds read. This occurs because a look-ahead entry in the attribute list is not properly validated, allowing data to be read beyond the...