CVE-2026-89614
A critical bug in the Linux kernel’s NTFS driver can cause an out‑of‑bounds read when allocating clusters on NTFS volumes whose bitmap size does not match the volume size. The flaw can lead to memory disclosure or a crash. The kernel has fixed the issue in newer releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users who mount NTFS volumes, especially on servers or desktops that use NTFS partitions where the $Bitmap size may not match the volume size.
Real-world impact
An attacker could read memory beyond the intended bounds, potentially exposing sensitive data or causing a system crash, which could lead to denial of service or information disclosure.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, and the fact that it can be exploited remotely without authentication or user interaction.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for the NTFS cluster allocation bug.
- 02Reboot the system to load the new kernel.
NVD description indicates the issue has been resolved in the kernel
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.