CVE-2026-89611

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate non-resident attribute offsets

ntfs_attr_update_meta() shifts the attribute name when converting between

non-sparse and sparse attributes. Converting to sparse also adds the

compressed_size field before the name and mapping pairs, requiring eight

additional bytes in the attribute record.

However, the validator does not check that name_offset is within safe

boundaries for these operations or that the additional space is available.

A malicious MFT record could set name_offset such that:

1. The name is positioned at the very end of a non-sparse attribute.

Converting to sparse would shift the name forward by 8 bytes,

writing beyond the attribute boundary.

2. The name overlaps with the mapping pairs, causing corruption during

conversion.

Add validation to ensure:

- For named attributes, name_offset is within valid bounds

- Name does not extend beyond the attribute or overlap with mapping pairs

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References