{"id":"CVE-2026-89616","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89616","summary":"fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()'s return value:\n\n  unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n                             frame_size);\n  if ((ssize_t)unc_size < 0)        err = unc_size;\n  else if (!unc_size || unc_size > frame_size)  err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file's\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero.","published":"2026-09-11T19:45:16.064Z","modified":"2026-09-14T03:46:21.210514505Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.12.109"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89616.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89616"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T03:46:21.210514505Z"}}