Answer in brief
CVE-2026-89782 records a High severity (CVSS 8.4) vulnerability in fs/ntfs3: reject restart table growth beyond U16_MAX entries. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b46acd6a6a627d876898e1c84d3f84902264b445 <caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <339e59996ff193adcf1c438cf05f19e753beb3a7 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <ecde45cd81dc28f5696c312c5ce5a509962e9ab1 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <be218a01aadffe33ed4fc73e25276d676ebbd09d || >=b46acd6a6a627d876898e1c84d3f84902264b445 <aad605a450611e2a7b7cf9dd5724004d39192bfb || >=b46acd6a6a627d876898e1c84d3f84902264b445 <967a5ff8a614d10126b6d46db1ac040948d6cb42 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <111f8d74a19d85942ecbb3aba78f6f3c88e59391 | caa0ec3fc44a13d7c21d78e4722f4f05f87ccf56, 339e59996ff193adcf1c438cf05f19e753beb3a7, ecde45cd81dc28f5696c312c5ce5a509962e9ab1, be218a01aadffe33ed4fc73e25276d676ebbd09d, aad605a450611e2a7b7cf9dd5724004d39192bfb, 967a5ff8a614d10126b6d46db1ac040948d6cb42, 111f8d74a19d85942ecbb3aba78f6f3c88e59391 |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_rec() only verifies that transact_id is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily large index. alloc_rsttbl_from_idx() grows the table to cover that index via extend_rsttbl(), which passes the new entry count to init_rsttbl(): rt = init_rsttbl(esize, used + add); used + add is computed as u32 but init_rsttbl() takes a u16, and the count is stored in struct RESTART_TABLE as a __le16. When used + add exceeds U16_MAX it is truncated, init_rsttbl() allocates a table far smaller than the index requires, and alloc_rsttbl_from_idx() then dereferences and writes at the original, untruncated offset -- an out-of-bounds access past the allocation, reachable by mounting a crafted NTFS image. BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) Read of size 4 at addr ffff8880327ffff8 by task exploit alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950) log_replay (fs/ntfs3/fslog.c:4562) ntfs_loadlog_and_replay (fs/ntfs3/fsntfs.c:324) ntfs_fill_super (fs/ntfs3/super.c:1393) get_tree_bdev_flags vfs_get_tree path_mount __x64_sys_mount A restart table is limited to U16_MAX entries by its __le16 count, so a larger growth request is invalid input. Reject it in extend_rsttbl(); all callers already handle a NULL return.
Quoted source text, attributed separately from HOL analysis.