{"id":"CVE-2026-89616","summary":"fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()'s return value:\n\n  unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n                             frame_size);\n  if ((ssize_t)unc_size \u003c 0)        err = unc_size;\n  else if (!unc_size || unc_size \u003e frame_size)  err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file's\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero.","modified":"2026-09-15T03:48:20.643632288Z","published":"2026-09-11T19:45:16.064Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89616.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89616.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89616"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4342306f0f0d5ff4315a204d315c1b51b914fca5"},{"fixed":"7d60a4c49af4d5cb88aa7cbf998d0408bd415055"},{"fixed":"cd40eee4923d104ebec9ac7513b971bc441e431d"},{"fixed":"77d8efd04745cda23858546afdbd9d07b591758e"},{"fixed":"0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"},{"fixed":"376ee45659a4b943df672ad275c63da00655f929"},{"fixed":"4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"},{"fixed":"35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89616.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.15.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89616.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}