External risk intelligence

Linux Kernel NTFS Attribute Offset Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89611

This vulnerability exists within the Linux kernel NTFS file system driver. It relates to the parsing of file system metadata (MFT records) on a local disk or storage volume. It is not a network-exposed service, API, or web application, and requires local access to process a malicious file system, making public internet reachability not applicable.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in the Linux kernel's NTFS file system driver that could allow an attacker to corrupt file system data by manipulating metadata within specially crafted Master File Table (MFT) records. This corruption could occur during the conversion of file attributes between different formats, potentially leading to system instability or data loss. The main concern is confirming relevance and exposure within your Linux environments utilizing NTFS.

Issue: Malicious file data could corrupt the file system.
Remember: NTFS attribute handling has a data corruption risk.
Takeaway: Verify if your Linux systems use NTFS.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to write to a file system could craft a malicious Master File Table (MFT) record. This record, when processed by the Linux kernel's NTFS driver during file system operations, could cause memory corruption due to improper validation of attribute offsets and space checks. This vulnerability could potentially lead to a complete system compromise.

Requires local file system write access.
Triggered by processing a crafted MFT record.
Allows arbitrary write, leading to code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's NTFS driver could allow a maliciously crafted Master File Table (MFT) record to corrupt file system metadata. This corruption could occur when the system attempts to convert between non-sparse and sparse attribute formats, potentially leading to system instability or data loss.

File system metadata.
Malicious MFT record processing.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability resides within the Linux kernel's NTFS file system driver, the primary responsibility likely falls to infrastructure or platform teams managing Linux systems. The initial step involves identifying all Linux systems that mount NTFS volumes, assessing their business criticality and exposure, and then determining the accountable owner for remediation planning.

Infrastructure/Platform teams own the issue.
Verify Linux systems mounting NTFS volumes.
Plan remediation based on criticality and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NTFS driver in the Linux kernel?

The NTFS driver is a component of the Linux kernel that allows the operating system to read and write data to storage volumes formatted with the Windows New Technology File System (NTFS). It is typically used in environments where Linux systems need to share data with Windows-based disks or manage external drives using that specific file system architecture.

How does CVE-2026-89611 cause memory corruption?

This vulnerability involves improper input validation. When the kernel processes specific file attributes, it fails to check if there is enough memory space or if offsets are correctly aligned. An attacker can craft a Master File Table (MFT) record that forces the driver to write data outside of its assigned boundaries, causing memory corruption or data integrity issues.

Do I need to worry about network attacks for this vulnerability?

No. This issue is triggered by the kernel processing a malformed file system record, not by remote network packets hitting a service. It does not trigger simply by connecting to the internet; it requires the system to mount or interact with a maliciously crafted, locally accessible NTFS volume.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is unlikely to be reached via the internet. Because the defect resides in the driver responsible for parsing local disk metadata, it is not a network-exposed service. Your primary focus should be on systems that perform manual or automated mounts of untrusted storage media.

What is the recommended first step to respond to this issue?

Start by identifying all Linux systems in your environment that actively mount NTFS-formatted volumes. You do not need to hunt for external internet exposure. Instead, prioritize systems that handle data from untrusted sources, such as external hard drives or user-supplied storage, and prepare to update your kernel through your standard distribution channels.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.