What is CVE-2026-89614?

CVE-2026-89614 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10, affecting Linux kernel versions from 7.1 onward and patched in 7.2.4 and 7.3-rc1. CVE-2026-89614 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-89614?

CVE-2026-89614 has a CVSS score of 9.8 out of 10, rated Critical severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-89614?

Yes, CVE-2026-89614 has been patched. Fixed versions include 7.2.4 and 7.3-rc1. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-89614 actively exploited?

CVE-2026-89614 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-89614

Critical

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the array. A run whose LCN lies in that gap takes the allocator straight there, since the caller passes the file's own last LCN as its locality hint. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. Clamp the scan to what that array covers, mirroring the max_index calculation the mount-time scan already uses, and reject a decoded LCN at or beyond nr_clusters in the mapping pairs decoder. Conforming volumes are unaffected.

Package Linux Kernel

Published 2026-09-11

Last modified 2026-09-13

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

9.8

out of 10

Critical

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 7.1 and later are affected. Fixed in 7.2.4, 7.3-rc1 and their respective stable series.

Affected from

≥ 7.1

Fixed in

✓ 7.2.4 7.2.x ✓ 7.3-rc1

References

2 total

Details

CVE ID CVE-2026-89614

Severity Critical

CVSS score 9.8 / 10

CVSS version 3.1

Published 2026-09-11

Modified 2026-09-13

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-89614?

CVE-2026-89614 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10 . It affects Linux kernel versions from 7.1 onward and has been patched in 7.2.4 and 7.3-rc1. CVE-2026-89614 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-89614?

CVE-2026-89614 has a CVSS score of 9.8 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-89614?

Yes. CVE-2026-89614 has been patched. Fixed versions include 7.2.4 and 7.3-rc1. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-89614 actively exploited?

No. CVE-2026-89614 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.