External risk intelligence

Linux Kernel NTFS Heap Memory Leak Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-89779

This vulnerability exists in the Linux kernel's NTFS file system driver. It requires a user or process to mount a specifically crafted, malicious NTFS disk image or partition. This is a local-only operation typically requiring elevated privileges and physical or local access to mount storage media; it is not reachable via a public-facing network service.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability in the NTFS file system driver could allow a specially crafted image to leak memory to userspace. While the issue has been resolved, it's important to confirm if your systems utilize this specific file system driver and are potentially exposed. The main concern is confirming relevance and exposure.

Unchecked file system record size can leak memory.
This impacts the NTFS file system driver in Linux.
Confirm relevance and potential exposure of NTFS usage.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by crafting a malicious NTFS disk image. When this image is mounted, the kernel's NTFS driver will attempt to read extended attributes (EAs), leading to a buffer overflow when processing a malformed EA record. This vulnerability could allow an attacker to read sensitive kernel memory, potentially exposing information to userspace.

Mounted malicious NTFS disk image.
Triggered by reading extended attributes.
Leaks kernel memory to userspace.

Live Threat

Current exploitation, exposure, and threat context

When a specially crafted NTFS image is processed by the Linux kernel's NTFS3 driver, it can lead to a heap memory leak. This occurs because the driver does not properly validate the size of extended attribute (EA) records, allowing an attacker to craft an oversized record that is then copied into an insufficiently allocated buffer, potentially exposing sensitive kernel memory contents to user space via the `getxattr()` system call.

Kernel memory could be leaked.
Malicious NTFS image on mounted media.
Information disclosure to user space.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Linux kernel's NTFS file system driver, specifically when handling extended attributes (EAs). Real-world ownership likely resides with the infrastructure or platform teams managing Linux systems, as well as potentially application owners if they are directly responsible for mounting or managing NTFS file systems. The initial step should be to identify all systems running the affected kernel version, confirm if any are mounting NTFS volumes, and then ascertain if those volumes are exposed to potentially untrusted input.

Infrastructure or platform teams own remediation.
Verify NTFS volume mount points and exposure.
Plan remediation during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ntfs3 driver in the Linux kernel?

The ntfs3 component is a driver within the Linux kernel that enables the operating system to read and write data on storage devices formatted with the NTFS file system. It is commonly used when Linux systems need to access, mount, or interact with partitions or external drives that were originally created on Windows environments.

What is the weakness behind CVE-2026-89779?

The vulnerability is an out-of-bounds read, a type of memory safety flaw. It happens because the driver fails to confirm that the reported size of a file record is large enough to contain its actual contents. Because this check is missing, the system may read data past the allocated memory buffer, potentially disclosing sensitive information from the kernel's memory to a user-level process.

How is this vulnerability triggered?

An attacker triggers the bug by providing a specifically crafted, malicious NTFS disk image to a vulnerable system. The vulnerability does not activate just by having the driver installed; it requires the actual mounting of a malicious image or partition, followed by an attempt to read extended attributes from a malformed record within that image.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely for most systems. While the CVE score might suggest a network-based threat, the bug is actually local. It requires someone to mount a malicious storage device, which typically necessitates physical or local access and elevated system permissions. It is generally not reachable through standard network services.

What should I do if I run Linux systems?

Prioritize identifying which of your systems currently mount NTFS-formatted storage. Once you have an inventory, focus your investigation on machines that handle external or untrusted media, as these are the most relevant targets for this specific driver-level issue. Plan to apply official kernel updates during your next routine maintenance window to resolve the underlying code defect.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.