CVE-2026-89779

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate ef->size covers the record's name and value

When an EA record has a non-zero ef->size, ntfs_read_ea() only checks

that the record fits in the remaining buffer (ea_size > bytes), not that

ef->size is large enough to hold the record's own name_len + 1 + elength.

A crafted image can pass validation with, e.g., ef->size = 24 but

elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of

the undersized record, reading past the kmalloc(info->size) allocation

and leaking heap memory to userspace via getxattr():

BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302)

Read of size 65535 at addr ffff888100794550 by task exploit

__asan_memcpy (mm/kasan/shadow.c:105)

ntfs_get_ea (fs/ntfs3/xattr.c:302)

ntfs_getxattr (fs/ntfs3/xattr.c:848)

__vfs_getxattr (fs/xattr.c:441)

vfs_getxattr (fs/xattr.c:474)

do_getxattr (fs/xattr.c:800)

path_getxattrat (fs/xattr.c:868)

do_s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References