CVE-2026-89613
This vulnerability affects the Linux kernel’s NTFS file‑system handling. An attacker could exploit an NTFS attribute with empty mapping pairs to crash the kernel or corrupt data, potentially leading to a denial of service or system compromise. The flaw has been fixed in a recent kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux systems that use the kernel’s NTFS driver and have not applied the latest kernel update. Typical users include servers and desktops running recent Linux distributions.
Real-world impact
An attacker could craft a malicious NTFS file that, when processed by the kernel, causes the system to crash or corrupt data, leading to a denial of service or potential compromise of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the flaw allows complete compromise of confidentiality, integrity, and availability with no authentication or user interaction required.
What to do about it
- 01Update your Linux kernel to a version that includes the fix for CVE-2026-89613.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.