From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F51144780D for ; Wed, 16 Sep 2026 08:49:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789548549; cv=none; b=GSGAyn8wgl8M3EgfYgUPPOQ7bwsIJUYJAuOhhth/nF30wmS+qgvt0tXiSQJkeT2xP+fSDnAlnn+Bzv6vmcOY6xr6h8eg18V0i//ntPwsV3NuxsvDWSBUYoUxXjHbdObKfCgewfKMN9flbtCSqC9ZqgCBXVbWOYnj8u3ErRyBr7I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789548549; c=relaxed/simple; bh=VPEb/NpYx4tuRm4v+GBookivFUuWu07fhvh6HpctGVA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QYTMMDyPkXWoT8infskEMyc0TKEiu8QkgwOxY0Ws4Kqh/61omEPnCDs5sPA3Bkwim+XXyroojijEC0n9Gn1QtP+n2kKUy2JFNt9zp79iZBLWIXc60tH1xHpTMbCYTbV0cLcyBjix84wcutRjhryZwLWnbzLZJYvQ4vMYB3iXTg8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Q8LQZLAG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Q8LQZLAG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CCEB1F000FF; Wed, 16 Sep 2026 08:49:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789548548; bh=Il5PN3Ik+RFqrK+1UPqzgf784+/MhuDaJK+gZmn5oVM=; h=From:To:Cc:Subject:Date:Reply-To; b=Q8LQZLAGTCf8y/7mOVr42DYXglnOoFIZlWtnpVbGnBly/ejkLP/yq0j6l+BB8jjUe aVm2K+XRHFZ9qYqbqf3NgzD4NTQIJbv68ZhkabqeIgBZHxITf63ArVt3I1DFXB5Gsa Tn7P6lLRHl/TfxqmE0w0IKSCGRaoX7Z7efYRAC7w= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89779: fs/ntfs3: validate ef->size covers the record's name and value Date: Wed, 16 Sep 2026 09:46:43 +0100 Message-ID: <2026091640-CVE-2026-89779-07ec@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4010; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=hsvt7UfV56ddX/H4j/Cfgxf2bn81cjqFgAphjulxnRA=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmrwguOHfA6Of/9Fn9RDZtli894q6/UWWhb+bBWdLWrP 48V/1+5jlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIn6cM8+tb+0v3c1qv+Msq Pu/6tArXXUkJVxjme2rMlb8XcNE16QZf+w3+X3rL71csAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength. A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr(): BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94) The buggy address is located 80 bytes inside of allocated 84-byte region in cache kmalloc-96 Compute the size the record needs and require ef->size to cover it. The Linux kernel CVE team has assigned CVE-2026-89779 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15.121 with commit 333feb7ba84f69f9b423422417aaac54fd9e7c84 and fixed in 5.15.221 with commit b27e68ad818a4ca2cef8f35f97e75d756714c818 Issue introduced in 6.1.40 with commit 000a9a72efa4a9df289bab9c9e8ba1639c72e0d6 and fixed in 6.1.188 with commit 28a924c7e67e6d71abeb04860b61166fecb027fc Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 6.6.157 with commit d585ed08308909c7e6fefb4e8a258aeb29b19ff9 Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 6.12.110 with commit 077df8464cf24f8ffc82fb6efec2ae600686e699 Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 6.18.52 with commit aab1880058ac767d3ea9388a9a7221c776c22c44 Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 7.2.6 with commit c8a109c9e23a2c7fd548473dde728b2cb8188146 Issue introduced in 6.2 with commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b and fixed in 7.3-rc1 with commit c22f91d82cb9a29d22bdffdce6c803467984ad0c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89779 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ntfs3/xattr.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b27e68ad818a4ca2cef8f35f97e75d756714c818 https://git.kernel.org/stable/c/28a924c7e67e6d71abeb04860b61166fecb027fc https://git.kernel.org/stable/c/d585ed08308909c7e6fefb4e8a258aeb29b19ff9 https://git.kernel.org/stable/c/077df8464cf24f8ffc82fb6efec2ae600686e699 https://git.kernel.org/stable/c/aab1880058ac767d3ea9388a9a7221c776c22c44 https://git.kernel.org/stable/c/c8a109c9e23a2c7fd548473dde728b2cb8188146 https://git.kernel.org/stable/c/c22f91d82cb9a29d22bdffdce6c803467984ad0c