SEPTEMBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-89612

CRITICAL · CVSS 9.8 EPSS 0.55%

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-13

CyberRota Analysis

AI-Generated

The vulnerability in the Linux kernel affects the NTFS boot sector, where invalid Master File Table (MFT) Logical Cluster Numbers (LCNs) can be improperly decoded, leading to potential out-of-bounds access. This flaw could allow an attacker to exploit memory management issues, potentially resulting in system instability or unauthorized access. Linux system administrators and developers utilizing NTFS should prioritize patching this vulnerability to mitigate associated risks.

CVE
CVE-2026-89612
Severity
CRITICAL
CVSS
9.8
EPSS
0.55%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.