CVE-2026-80673
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's NTFS filesystem, ntfs_external_attr_find() improperly bounds-checks the next attribute-list entry, potentially leading to a slab out-of-bounds read with a crafted disk. The fix adds validation of the entry before dereferencing.
Risk Assessment
The vulnerability could allow an attacker to read data beyond the allocated buffer, potentially leading to information disclosure or system crashes when mounting a malicious NTFS disk.
Recommendation
Update the Linux kernel to a version containing the fix that validates attribute-list entries. Avoid mounting untrusted NTFS disks until the patch is applied.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read. Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.