CVE-2026-89785

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

ntfs_reparse_init() and ntfs_objid_init() parse the index root of the

$Extend/$Reparse and $Extend/$ObjId metafiles (the INDEX_ROOT attributes

named $R and $O). They read its type and rule fields through

resident_data(), which does not check that the resident attribute is

large enough to hold them.

mi_enum_attr() accepts a resident attribute with data_off == asize and

data_size == 0. For such an attribute placed last in its MFT record,

resident_data() returns a pointer to the end of the record_size buffer,

so reading root->type / root->rule reads past the allocation.

Use resident_data_ex(attr, sizeof(struct INDEX_ROOT)) and bail out when

it returns NULL, as ntfs_security_init() already does for $SDH / $SII.

The attribute is only parsed while mounting a crafted image, so this

needs CAP_SYS_ADMIN.

BUG: KASAN: slab-out-of-bounds in ntfs_reparse_in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References