Answer in brief
CVE-2026-89616 records a High severity (CVSS 7.5) vulnerability in fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <376ee45659a4b943df672ad275c63da00655f929 || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <4a1b39b2e10eb8de86265e80cf2be4396bc1dce4 || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd | 0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea, 376ee45659a4b943df672ad275c63da00655f929, 4a1b39b2e10eb8de86265e80cf2be4396bc1dce4, 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd |
| Linux/Linuxgeneric | 5.15 | Not reported |
| Linux/Linuxgeneric | >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <7d60a4c49af4d5cb88aa7cbf998d0408bd415055 || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <cd40eee4923d104ebec9ac7513b971bc441e431d || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <77d8efd04745cda23858546afdbd9d07b591758e || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <376ee45659a4b943df672ad275c63da00655f929 || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <4a1b39b2e10eb8de86265e80cf2be4396bc1dce4 || >=4342306f0f0d5ff4315a204d315c1b51b914fca5 <35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd | 7d60a4c49af4d5cb88aa7cbf998d0408bd415055, cd40eee4923d104ebec9ac7513b971bc441e431d, 77d8efd04745cda23858546afdbd9d07b591758e, 0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea, 376ee45659a4b943df672ad275c63da00655f929, 4a1b39b2e10eb8de86265e80cf2be4396bc1dce4, 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress_lznt()'s return value: unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem, frame_size); if ((ssize_t)unc_size < 0) err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL; decompress_lznt() stops as soon as the compressed stream is exhausted (e.g. a zero chunk header) and returns the number of bytes it actually wrote, which may be far less than frame_size. The bytes between unc_size and frame_size are never written. The only memset() that follows zeroes the region beyond i_valid; when the frame lies entirely within the file's valid size that memset() does not run, so the gap retains whatever was in the just-vmapped pages. All pages are then marked uptodate and returned to userspace, disclosing uninitialized (recently-freed) kernel page memory. A crafted compressed file whose stream decompresses to only a few bytes leaks the remainder of every frame on a plain read(2), which is enough to recover kernel pointers and defeat KASLR. Zero the [unc_size, frame_size) tail immediately after a successful LZNT decompress so the remainder reads back as zero.
Quoted source text, attributed separately from HOL analysis.