Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2026-89611

A flaw in the Linux kernel’s NTFS driver allows an attacker to craft a malicious MFT record that can overflow or corrupt the attribute data. The bug occurs because the driver does not validate the name offset when converting attributes, potentially writing beyond the intended buffer. The issue has been fixed in a kernel update.

publishedSep 11, 2026
last modifiedSep 13, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
5th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 13, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Linux systems that use the NTFS file‑system driver, such as those mounting Windows partitions or using NTFS‑formatted external drives.

02

Real-world impact

An attacker could corrupt or overwrite data on an NTFS volume, potentially causing system crashes or data loss. If the attacker can control the MFT record, they might also trigger arbitrary code execution or privilege escalation.

03

Why this severity

The CVSS score of 9.8 reflects a network‑accessible vulnerability that requires no user interaction, has low complexity, and grants an attacker full control over confidentiality, integrity, and availability of the affected system.

04

What to do about it

official fix available
recommended steps
  1. 01Update the Linux kernel to a version that includes the NTFS attribute validation fix for CVE-2026-89611.

NVD description indicates the issue has been resolved.

05

Timeline

  1. Sep 11, 2026 · 2d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Sep 13, 2026 · 8h ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
CVE-2026-89611: A flaw in the Linux kernel’s NTFS driver allows an attacker to craft a · Vulnary