CVE-2026-89616

A flaw in the Linux kernel's NTFS3 LZNT decompression path can expose uninitialized kernel page contents when reading a crafted compressed file. Bynario demonstrated that the disclosure can recover kernel pointers and determine the randomized kernel base, defeating KASLR and providing information useful for follow-on exploitation.

ni_read_frame() decompresses an LZNT $DATA frame into vmapped target pages and trusts the byte count returned by decompress_lznt(). When the compressed stream ends early, the decompressor may write substantially less than frame_size, leaving the tail between unc_size and frame_size untouched. If the frame lies within the file's valid-data range, the later zeroing logic does not cover that gap; the pages are nevertheless marked up to date and returned to userspace.

In Bynario's validation with KASLR enabled, a crafted file disclosed 3,341,928 nonzero bytes from a 4,193,792-byte read and exposed enough kernel pointers to recover the kernel base. The patch explicitly clears [unc_size, frame_size) after successful partial decompression. Bynario classifies the issue as CWE-908.

References

• NVD record

• Linux stable fix