CVE-2026-90133 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches or mitigations as needed. They should verify patch application, assess the vulnerability status of Linux kernel versions in use, and monitor for crafted filesystem images that could trigger the vulnerability.

Why it matters

This vulnerability could allow an attacker to cause a heap out-of-bounds write by providing a crafted filesystem image, potentially leading to system instability or security issues. Linux kernel developers, maintainers, and users should verify patch application and assess exposure.

• Verify patch application to prevent potential OOB writes.
• Monitor for crafted filesystem images that could trigger the vulnerability.
• Assess the vulnerability status of Linux kernel versions in use.

Technical summary

The vulnerability is caused by a lack of bounds checking in ntfs_ir_to_ib() when copying entries from index_root into a buffer. This can lead to heap out-of-bounds writes when the entries are larger than the usable space in the index block. The issue arises from the memcpy operation in ntfs_ir_to_ib(), which does not validate the size of the entries against the available buffer space. This oversight allows an attacker to provide a crafted filesystem image that can trigger the OOB write, potentially leading to system instability or security issues.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch provided by the Linux kernel maintainers.
• Verify the vulnerability status of your Linux kernel versions.
• Monitor for potential crafted filesystem images that could trigger the vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.