{"id":"AZL-100625","summary":"CVE-2026-89615 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound page_lcns[] index by the log record\n\nThe copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,\nwhere i runs up to the log record's lcns_follow. That count is checked only\nagainst the record's own length, not the target entry, so check_dp_table()\n(which validates the entry's lcns_follow) does not cover it: the copy_lcns\nentry may even be freshly allocated after that check, and find_dp() bounds j\nbut not i. A crafted record thus overflows page_lcns[] of an otherwise valid\nentry.\n\nAdd dp_range_ok() and reject, before each loop, any record whose run does\nnot fit the entry. These are the only two page_lcns[] accesses indexed by\nthe record rather than the entry, so together with the entry validation\nevery access is now bounded.\n\n[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]","modified":"2026-09-14T05:26:59Z","published":"2026-09-11T20:19:46Z","upstream":["CVE-2026-89615"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89615"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100625.json"}}],"schema_version":"1.9.0"}