CVE-2026-89779: fs/ntfs3: validate ef->size covers the record's name and value

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate ef->size covers the record's name and value

When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
that the record fits in the remaining buffer (ea_size > bytes), not that
ef->size is large enough to hold the record's own name_len + 1 + elength.

A crafted image can pass validation with, e.g., ef->size = 24 but
elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of
the undersized record, reading past the kmalloc(info->size) allocation
and leaking heap memory to userspace via getxattr():

 BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302)
 Read of size 65535 at addr ffff888100794550 by task exploit
  __asan_memcpy (mm/kasan/shadow.c:105)
  ntfs_get_ea (fs/ntfs3/xattr.c:302)
  ntfs_getxattr (fs/ntfs3/xattr.c:848)
  __vfs_getxattr (fs/xattr.c:441)
  vfs_getxattr (fs/xattr.c:474)
  do_getxattr (fs/xattr.c:800)
  path_getxattrat (fs/xattr.c:868)
  do_syscall_64 (arch/x86/entry/syscall_64.c:94)

 The buggy address is located 80 bytes inside of
  allocated 84-byte region in cache kmalloc-96

Compute the size the record needs and require ef->size to cover it.

The Linux kernel CVE team has assigned CVE-2026-89779 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15.121 with commit 333feb7ba84f69f9b423422417aaac54fd9e7c84 and fixed in 5.15.221 with commit b27e68ad818a4ca2cef8f35f97e75d756714c818
	Issue introduced in 6.1.40 with commit 000a9a72efa4a9df289bab9c9e8ba1639c72e0d6 and fixed in 6.1.188 with commit 28a924c7e67e6d71abeb04860b61166fecb027fc
	Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 6.6.157 with commit d585ed08308909c7e6fefb4e8a258aeb29b19ff9
	Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 6.12.110 with commit 077df8464cf24f8ffc82fb6efec2ae600686e699
	Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 6.18.52 with commit aab1880058ac767d3ea9388a9a7221c776c22c44
	Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 7.2.6 with commit c8a109c9e23a2c7fd548473dde728b2cb8188146
	Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 7.3-rc1 with commit c22f91d82cb9a29d22bdffdce6c803467984ad0c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89779
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ntfs3/xattr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b27e68ad818a4ca2cef8f35f97e75d756714c818
	https://git.kernel.org/stable/c/28a924c7e67e6d71abeb04860b61166fecb027fc
	https://git.kernel.org/stable/c/d585ed08308909c7e6fefb4e8a258aeb29b19ff9
	https://git.kernel.org/stable/c/077df8464cf24f8ffc82fb6efec2ae600686e699
	https://git.kernel.org/stable/c/aab1880058ac767d3ea9388a9a7221c776c22c44
	https://git.kernel.org/stable/c/c8a109c9e23a2c7fd548473dde728b2cb8188146
	https://git.kernel.org/stable/c/c22f91d82cb9a29d22bdffdce6c803467984ad0c