HIGH Introduced in 5.15
ntfs3 LZNT Decompress Leak
CVE-2026-89616
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
KernelScan AI5.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress_lznt()'s return value: unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem, frame_size); if ((ssize_t)unc_size < 0) err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL; decompress_lznt() stops as soon as the compressed stream is exhausted (e.g. a zero chunk header) and returns the number of bytes it actually wrote, which may be far less than frame_size. The bytes between unc_size and frame_size are never written. The only memset() that follows zeroes the region beyond i_valid; when the frame lies entirely within the file's valid size that memset() does not run, so the gap retains whatever was in the just-vmapped pages. All pages are then marked uptodate and returned to userspace, disclosing uninitialized (recently-freed) kernel page memory. A crafted compressed file whose stream decompresses to only a few bytes leaks the remainder of every frame on a plain read(2), which is enough to recover kernel pointers and defeat KASLR. Zero the [unc_size, frame_size) tail immediately after a successful LZNT decompress so the remainder reads back as zero.
02KernelScan AI Analysis
Risk summary
A crafted NTFS3 compressed file causes the kernel to return uninitialized page memory to userspace on a plain read, leaking kernel pointers and defeating KASLR. The filesystem image must be mounted on the target—via removable media with automount or a privileged manual mount—after which any local user who can read the file triggers the leak. Products with exposed USB/SD ports or interactive root access are most at risk; sealed enclosures or appliance-mode deployments without removable media are less exposed.
Vulnerability analysis
When reading a compressed NTFS3 file, the decompression step may produce fewer bytes than the expected frame size if the compressed stream ends prematurely. The original code did not zero the unwritten portion of the page buffer, so the gap retained whatever was previously in that kernel memory. Those pages were then marked valid and returned to userspace through a normal read call, exposing uninitialized kernel memory that could contain pointers and defeat KASLR. The fix zeroes the unwritten tail immediately after a successful but partial decompression so the remainder reads back as zero. An attacker must get a crafted NTFS3 filesystem image mounted on the target—via removable media with automount or a privileged manual mount—after which any local user who can read the file triggers the leak.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15 | 5.15.221 | 7d60a4c49af4 |
| 6.6 | 5.15 | 6.6.157 | 77d8efd04745 |
| 6.12 | 5.15 | 6.12.109 | 0f699ddb290a |
| 6.18 | 5.15 | 6.18.50 | 376ee45659a4 |
| mainline | 5.15 | 7.3-rc1 | 35d1ea92c7d9 |
| 7.2 | 5.15 | 7.2.4 | 4a1b39b2e10e |
| 6.1 | 5.15 | 6.1.188 | cd40eee4923d |
| cip/6.12 | 5.15 | 6.12.111-cip32 | 0f699ddb290a |