---
title: "CVE-2026-89615: Linux kernel - Buffer Overflow"
description: "Linux kernel fs/ntfs3 contains a buffer overflow caused by improper bounds checking of page_lcns[] index in copy_lcns and redo shorten loops, letting attackers cause memory corruption, exploit requires crafted NTFS log record."
url: https://panop.io/threat-heartbeat/CVE-2026-89615/
---

# CVE-2026-89615 Linux kernel - Buffer Overflow

Linux kernel fs/ntfs3 contains a buffer overflow caused by improper bounds checking of page\_lcns\[\] index in copy\_lcns and redo shorten loops, letting attackers cause memory corruption, exploit requires crafted NTFS log record.

CVSS base score 8.4 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Not required

EPSS

0.15% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89615)

## Details

Type

Buffer Overflow

Impact

Denial Of Service, Remote Code Execution

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version containing the patch for fs/ntfs3 page\_lcns\[\] bounds checking.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89615](https://nvd.nist.gov/vuln/detail/CVE-2026-89615)
- [https://git.kernel.org/stable/c/61ca8cbbf68f77f25b699ed4358bd232f94ed43b](https://git.kernel.org/stable/c/61ca8cbbf68f77f25b699ed4358bd232f94ed43b)
- [https://git.kernel.org/stable/c/bb742d1030864c0fe140666f639428ba4e90b2ca](https://git.kernel.org/stable/c/bb742d1030864c0fe140666f639428ba4e90b2ca)
- [https://git.kernel.org/stable/c/1135ebc225996b3ac1a295652b19a0a706737a6c](https://git.kernel.org/stable/c/1135ebc225996b3ac1a295652b19a0a706737a6c)
- [https://git.kernel.org/stable/c/6f7b9dbdc1b7520206abce0049bdd143eb536e75](https://git.kernel.org/stable/c/6f7b9dbdc1b7520206abce0049bdd143eb536e75)
- [https://git.kernel.org/stable/c/7ccb94901f38a062034b56b43c774050b113758f](https://git.kernel.org/stable/c/7ccb94901f38a062034b56b43c774050b113758f)
- [https://git.kernel.org/stable/c/f4c1bc6d7331f344ffcea93c2a37badcbe15baa6](https://git.kernel.org/stable/c/f4c1bc6d7331f344ffcea93c2a37badcbe15baa6)
- [https://git.kernel.org/stable/c/31fdd11f75da9823500168cecb07aa45130915a3](https://git.kernel.org/stable/c/31fdd11f75da9823500168cecb07aa45130915a3)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)