CVE-2026-89611
A flaw in the Linux kernel’s NTFS driver allows an attacker to craft a malicious MFT record that can overflow or corrupt the attribute data. The bug occurs because the driver does not validate the name offset when converting attributes, potentially writing beyond the intended buffer. The issue has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems that use the NTFS file‑system driver, such as those mounting Windows partitions or using NTFS‑formatted external drives.
Real-world impact
An attacker could corrupt or overwrite data on an NTFS volume, potentially causing system crashes or data loss. If the attacker can control the MFT record, they might also trigger arbitrary code execution or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects a network‑accessible vulnerability that requires no user interaction, has low complexity, and grants an attacker full control over confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Update the Linux kernel to a version that includes the NTFS attribute validation fix for CVE-2026-89611.
NVD description indicates the issue has been resolved.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.