CVE-2026-80598 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix out-of-bounds read in decompress_lznt
decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.
Add index bounds checking to prevent the OOB access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's ntfs3 filesystem driver contains a critical vulnerability within its LZNT compression implementation, specifically in the decompress_lznt function. This flaw stems from a failure to perform adequate input validation before processing compressed data streams derived from NTFS volumes. The underlying technical issue is an out-of-bounds read condition that occurs when the driver attempts to access entries in a decompression lookup table using indices extracted directly from the corrupted file system image without verifying that these indices fall within the valid range of the table's allocated memory space. This lack of boundary checking allows malformed or maliciously crafted compressed data segments to cause the kernel to read memory locations outside the intended buffer boundaries, potentially exposing sensitive kernel memory contents to an attacker who can influence the content of the NTFS volume being accessed.
From a technical perspective, this vulnerability represents a classic instance of improper input validation leading to out-of-bounds memory access. The decompress_lznt routine is responsible for interpreting compressed data blocks within NTFS3 files, relying on index values embedded in the compression headers or stream structures to look up decoding parameters from a static table. When an attacker provides a specially crafted NTFS image containing invalid compressed data with manipulated indices, the kernel executes memory reads beyond the allocated array limits. This behavior aligns closely with CWE-125, which describes out-of-bounds read vulnerabilities where software accesses memory past the end of or before the beginning of the intended buffer. Such flaws are particularly dangerous in kernel-space code because they can lead to information disclosure, denial of service through system crashes, and potentially arbitrary code execution if the leaked data aids further exploitation steps.
The operational impact of this vulnerability is significant for systems that mount untrusted NTFS volumes or process files from external storage devices formatted with NTFS3. An attacker who gains physical access to a machine can plug in a maliciously constructed USB drive containing an NTFS partition with corrupted compressed metadata, triggering the out-of-bounds read upon file system inspection or file opening operations. This could result in kernel panics causing denial of service for local users and services running on the affected system. Furthermore, depending on the specific memory layout and compiler optimizations, the leaked information might reveal pointers to other kernel structures, facilitating more advanced attacks such as privilege escalation. The vulnerability is exploitable locally without requiring prior authentication if the attacker can mount or access the malicious volume, making it a serious threat in multi-user environments or systems handling removable media from untrusted sources.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that introduces strict index bounds checking within the decompress_lznt function before any table lookups occur. System administrators should ensure their kernels are updated to versions where this fix is included, typically by updating to recent stable releases of the mainline Linux kernel or distributions' security-supported kernel packages. In addition to software updates, operational mitigations include restricting access to NTFS-formatted removable media and implementing strict policies on mounting external storage devices in production environments. Security teams should also monitor for signs of system instability or unexpected kernel log messages related to ntfs3 operations as indicators of potential exploitation attempts. Aligning with the MITRE ATT&CK framework, this vulnerability falls under techniques involving memory corruption and potentially information discovery via CWE-125, emphasizing the need for robust input validation in file system drivers that handle untrusted external data sources.