The vulnerability (CVE-2026-89616) exists in the Linux kernel's NTFS3 driver, specifically in the ni_read_frame() function that decompresses LZNT $DATA frames. The function relies on decompress_lznt() to decompress data but does not zero out the memory region beyond the decompressed data if the decompressed size is less than the frame size. This leads to uninitialized kernel memory being exposed to userspace on a read operation. An attacker can craft a compressed file that decompresses to only a few bytes, causing leakage of kernel memory contents, including kernel pointers, which can be used to bypass KASLR protections.

The vulnerability allows an attacker with access to read NTFS filesystem data to leak uninitialized kernel memory, including kernel pointers. This information disclosure can aid in bypassing kernel memory protection mechanisms such as KASLR, potentially facilitating further exploitation.

The vulnerability has been resolved by zeroing the memory region beyond the decompressed data immediately after a successful LZNT decompression in the ni_read_frame() function. Users should apply the official Linux kernel update that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.