Linux Kernel CVE-2026-89610

Requires the target to mount or otherwise parse an attacker-controlled NTFS volume using the Linux kernel's ntfs3 driver - i.e., the malicious image must reach the mapping-pairs decoder. Limiting factors: the vulnerable operation is local filesystem parsing, not a network service, so an attacker needs either the ability to mount filesystems (mount privilege) or a system configured to auto-mount removable media (USB insertion / automount daemon); systems that never mount untrusted NTFS media, or that have the ntfs3 module disabled, are not exposed. The claimed network vector (AV:N) is not supported by the description.

The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is substantially overstated for this class of bug: exploitation requires the victim system to mount or process an attacker-supplied NTFS image, which is a local, filesystem-parsing operation rather than a remotely reachable network service - a realistic vector is AV:L, typically gated on either mount privileges or an automount/USB-insertion path. EPSS (0.20%, 10th percentile) and the absence of KEV or POC corroborate that this is not currently a widespread exploitation risk. The most defensible practical impact is denial of service (kernel oops/panic on OOB access), with memory corruption and privilege escalation being plausible but unproven upper bounds asserted by the description. This is best treated as a routine-but-important kernel hardening patch for any system that mounts untrusted NTFS media (multi-user hosts, forensics/analysis boxes, kiosks, USB-auto-mounting desktops), not a drop-everything network emergency; organizations should fold it into normal stable-kernel patching cadence unless they specifically mount untrusted removable media.

An attacker crafts a malicious NTFS filesystem image with a mapping-pairs array whose run starts inside the volume but whose length extends past nr_clusters, then delivers it as a USB stick or disk image. When a victim (or an automount service) mounts the image and the ntfs3 driver decodes the runlist, the kernel reads/writes beyond the volume boundary, crashing the system or corrupting kernel memory with potential for local privilege escalation. No public POC is currently identified.