---
id: CVE-2026-89616
title: >-
  kernel: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
  (CVE-2026-89616)
summary: >-
  A flaw was found in the Linux kernel's NTFS3 filesystem driver. When
  decompressing LZNT data, the `ni_read_frame()` function may not fully zero out
  memory after a partial decompression. This can lead to the disclosure of
  previously used ke…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-908
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    7d60a4c49af4d5cb88aa7cbf998d0408bd415055
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    cd40eee4923d104ebec9ac7513b971bc441e431d
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    77d8efd04745cda23858546afdbd9d07b591758e
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    376ee45659a4b943df672ad275c63da00655f929
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    4a1b39b2e10eb8de86265e80cf2be4396bc1dce4
  - >-
    Linux >= 4342306f0f0d5ff4315a204d315c1b51b914fca5 <
    35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd
  - Linux 5.15
published: '2026-09-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T22:36:58+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89616.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89616.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89616'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532395'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89616'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89616'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89616.mbox
  - url: 'https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055'
  - url: 'https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d'
  - url: 'https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e'
  - url: 'https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea'
  - url: 'https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929'
  - url: 'https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4'
  - url: 'https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00415
epssPercentile: 0.35492
scores:
  vendor: 5.5
  cna: 7.5
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the `ni_read_frame()` function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially crafted compressed file. Successful exploitation could allow an attacker to obtain sensitive kernel pointers, potentially bypassing Kernel Address Space Layout Randomization (KASLR) and aiding further attacks.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89616.json)

**kernel: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()** — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-18.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.