Out-of-bounds read in Linux kernel - CVE-2026-89614

Vulnerability details

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the NTFS cluster allocator when extending a file on an NTFS volume. A local user can extend a file whose last logical cluster number lies outside the volume's cluster range to read out-of-bounds memory.

Exploitation requires a volume whose $Bitmap covers more clusters than the volume.

Affected software

How to mitigate CVE-2026-89614

External References

• https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d
• https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471

Related Security Bulletins

• Out-of-bounds read in Linux kernel ntfs