CVE-2026-89614

CVE-2026-89614 affects the Linux kernel's NTFS file system driver . The flaw is in ntfs_cluster_alloc(), which bounds its free-cluster bitmap scan by the size of the on-disk $Bitmap rather than by the volume's actual cluster count (nr_clusters). Because these are independent quantities, a special...

CVE-2026-89613

A flaw in the Linux kernel's NTFS filesystem driver occurs when it processes an attribute with empty mapping pairs that have an inconsistent highest Virtual Cluster Number (VCN) and size. The fix rejects such invalid attributes. Red Hat describes the impact as a denial of service : a local attack...

EUVD-2026-76524

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

CVE-2026-89612

CVE-2026-89612 is a vulnerability in the Linux kernel's NTFS filesystem driver . The function parse_ntfs_boot_sector() decoded MFT and MFTMirr Logical Cluster Numbers (LCNs) from the NTFS boot sector into a signed 64-bit integer (s64), even though they are stored as unsigned 64-bit values. A craf...

CVE-2026-89612 ntfs: reject invalid MFT LCNs from boot sector

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

CVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

CVE-2026-89612 ntfs: reject invalid MFT LCNs from boot sector

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89611 ntfs: validate non-resident attribute offsets

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89611

This vulnerability affects the Linux kernel NTFS driver in ntfs_attr_update_meta(), where insufficient validation of non-resident attribute offsets during sparse/non-sparse conversion allows a malicious MFT record to cause out-of-bounds writes or data overlap with mapping pairs. Red Hat describes...

EUVD-2026-76523

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89611 ntfs: validate non-resident attribute offsets

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89610 ntfs: verify run length exceeding volume boundary

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

EUVD-2026-76522

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

CVE-2026-89610

CVE-2026-89610 affects the Linux kernel NTFS subsystem . The mapping pairs decoder validates that the starting LCN is within the volume but fails to check whether the run length extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array can cause the kernel to a...

CVE-2026-89610 ntfs: verify run length exceeding volume boundary

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

CVE-2026-89610

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

CVE-2024-27518

CVE-2024-27518 - SUPERAntiSpyware Professional X LPE PoC This vulnerability was discovered and disclosed by M. Akil Gündoğan from Secunnix Vulnerability Research Team. This repository will hold the proof-of concept and advisories. Details: Product: SUPERAntiSpyware Professional X and all editions...

process-enumeration-stealth

🚴 process-enumeration-stealth 这是什么？ 这是一个简单的 PoC，它允许你通过查询 \ntfs\ 基础设备（Windows 文件系统基础对象）返回当前正在使用 NTFS 的 PID 列表。使用这种方法无需使用典型 API，如 NtQuerySystemInformation 或更高级的 EnumProcesses。使用这种非典型的侦察方法可以让操作者规避端点上的典型监控 🎉。感谢 Jonas Lyk 最初发现了这个技巧。 它是如何工作的？ 1. 使用 GENERICREAD | SYNCHRONIZE 获取 \ntfs\ 的句柄 2. 使用...

symboliclink-testing-tools

symboliclink-testing-tools c Google Inc. 2015 開発者: James Forshaw これは、Windowsのさまざまなシンボリックリンクの種類をテストするための小さなツール群です。以下のツールで構成されています： root@kitploit: BaitAndSwitch : シンボリックリンクを作成し、OPLOCKを使用してTOCTOU競合に勝利します CreateDosDeviceSymlink: csrssを使用してオブジェクトマネージャのシンボリックリンクを作成します CreateMountPoint:...