CVE-2026-89614Medium· 5.5▾ SunlitA flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more cluster…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 4.7
0.2% → 0.4%
— → 4.7
none → medium
— → 9.8
none → critical
9.8 → 4.7
critical → medium
4.7 → 9.8
medium → critical
9.8 → 4.7
critical → medium
Last analysed / modified upstream
4.7 → 5.5
A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-bounds read when a file on such a volume is extended. This could result in system instability or the disclosure of sensitive information.
kernel: ntfs: bound the free-cluster bitmap scan to the volume — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-16.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80958Medium· 5.5kernel: dm-pcache: clamp the tail kset read to the segment data region (CVE-2026-80958)
CVE-2026-80959Medium· 5.5kernel: dm-pcache: bound the persisted tail-position offset (CVE-2026-80959)
CVE-2026-89571Medium· 5.5kernel: cxl/features: bound fwctl command payload to the input buffer (CVE-2026-89571)
CVE-2026-80962Medium· 5.5kernel: dm-pcache: validate geometry fields from on-disk cache_info (CVE-2026-80962)
CVE-2026-89743Medium· 6.3kernel: Linux kernel: NSM information disclosure via out-of-bounds read (CVE-2026-89743)
CVE-2026-89621Medium· 5.5kernel: HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)