CVE-2026-80673

Received Received - Intake

Out-of-Bounds Read in Linux Kernel NTFS Filesystem

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read. Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80673

EUVD

EUVD-2026-67549

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the NTFS file system driver. It involves an out-of-bounds read when resolving attribute lookups. The function ntfs_external_attr_find() incorrectly validates a look-ahead attribute-list entry, allowing it to read memory past the allocated buffer. This happens because the function checks only partial bounds before accessing fields like lowest_vcn and name, which can lie outside the valid memory region.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem handling. Detection requires checking kernel versions and NTFS-related logs or errors. Use commands like 'uname -a' to check kernel version and 'dmesg | grep ntfs' to look for NTFS-related errors.

Impact Analysis

This vulnerability could allow an attacker with access to a crafted NTFS filesystem to read sensitive kernel memory. This might lead to information disclosure, privilege escalation, or system crashes. Users running vulnerable Linux kernels with NTFS support could be affected if an attacker provides a maliciously formatted NTFS filesystem.

Compliance Impact

This vulnerability is a slab out-of-bounds read in the Linux kernel's NTFS filesystem driver. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory safety issue rather than a data protection or privacy violation.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to fix the NTFS vulnerability. Avoid mounting untrusted NTFS filesystems until patched. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-80673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70