{"id":21537,"date":"2026-09-12T04:31:19","date_gmt":"2026-09-11T20:31:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89615"},"modified":"2026-09-12T04:31:19","modified_gmt":"2026-09-11T20:31:19","slug":"cve-2026-89615","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89615","title":{"rendered":"CVE-2026-89615 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfs\/ntfs3: bound page_"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: bound page_lcns[] index by the log record<\/p>\n<p>The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,<br \/>\nwhere i runs up to the log record&#8217;s lcns_follow. That count is checked only<br \/>\nagainst the record&#8217;s own length, not the target entry, so check_dp_table()<br \/>\n(which validates the entry&#8217;s lcns_follow) does not cover it: the copy_lcns<br \/>\nentry may even be freshly allocated after that check, and find_dp() bounds j<br \/>\nbut not i. A crafted record thus overflows page_lcns[] of an otherwise valid<br \/>\nentry.<\/p>\n<p>Add dp_range_ok() and reject, before each loop, any record whose run does<br \/>\nnot fit the entry. These are the only two page_lcns[] accesses indexed by<br \/>\nthe record rather than the entry, so together with the entry validation<br \/>\nevery access is now bounded.<\/p>\n<p>[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: bound page_lcns[] index by the log record<\/p>\n<p>The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,<br \/>\nwhere<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21537","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}