Riskcovery

CVE-2026-89612

ntfs: reject invalid MFT LCNs from boot sector

State
Published
Severity
9.8 Critical
Published
Sep 11, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid MFT LCNs from boot sector

The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64.

A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 11ccc9107dc460de28af90fac1f42404d9802735 to before 8f8420b68a6f05ca2b03779d8208814ec539b9e5Affected
  • 11ccc9107dc460de28af90fac1f42404d9802735 to before cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2Affected
LinuxLinux
  • 7.1Affected
  • before 7.1Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.