CVE-2026-80673 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read.
Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's NTFS file system driver contains a critical out-of-bounds memory read vulnerability within the ntfs_external_attr_find function, which is responsible for locating specific attributes on an NTFS volume. This flaw arises from insufficient validation of look-ahead entries in the attribute list structure during attribute resolution operations that involve non-zero lowest virtual cluster numbers. When the file system driver attempts to determine whether a search should continue by examining the next entry in the $ATTRIBUTE_LIST stream, it performs bounds checking that is technically inadequate for preventing access beyond the allocated buffer boundaries. The existing validation logic only verifies that bytes zero through six of the potential look-ahead entry remain within the valid range and checks if the end of the attribute data stays within limits based on a length field provided by the attacker-controlled input.
The core technical deficiency lies in the misalignment between the bounds checking mechanism and the actual memory layout of NTFS attribute list entries. The code validates that the header portion fits but fails to account for the full size required to safely read subsequent fields such as lowest_vcn, which is a sixty-four-bit little-endian integer located at offset eight within the entry structure. Additionally, the driver proceeds to access name data based on an offset value stored in the unvalidated entry without ensuring that this specific region also resides within the allocated kvmalloc buffer boundaries. Because the attribute list size is derived directly from disk metadata without rounding or additional safety margins, a crafted NTFS image containing a final attribute list entry positioned just shy of the end boundary can trigger a slab out-of-bounds read when an inode referencing such structures is accessed by user space applications.
This vulnerability represents a classic case of improper input validation leading to memory corruption risks classified under CWE-125 as Out-of-Bounds Read and potentially CWE-20 as Improper Input Validation within the context of file system parsing logic. From a threat modeling perspective, this flaw aligns with ATT&CK technique T1083 which involves File and Directory Discovery, although the exploitation vector requires an attacker to provide maliciously crafted disk images or mountable volumes rather than interacting directly with live network services. The operational impact includes potential kernel information disclosure where sensitive memory contents adjacent to the attribute list buffer may be leaked into user space through error handling paths or logging mechanisms that expose pointer values or stack data associated with the out-of-bounds access. In worst-case scenarios involving specific compiler optimizations and heap layout conditions, such reads could facilitate further exploitation chains leading to arbitrary code execution if combined with other vulnerabilities in the kernel memory management subsystem.
The resolution implemented by the Linux kernel maintainers addresses this issue by introducing a dedicated validation function named ntfs_attr_list_entry_is_valid which is invoked prior to dereferencing critical fields within attribute list entries. This new routine ensures that all necessary components of an entry including headers, length indicators, and name offsets are verified against buffer boundaries before any data access occurs. By applying consistent boundary checks across both the primary walk logic and look-ahead evaluations, the patch eliminates the possibility of reading past the allocated kvmalloc region associated with attribute lists. System administrators should apply kernel updates containing this fix to mitigate risks associated with processing untrusted NTFS media or virtual disk images that may contain malformed file system structures designed to trigger these memory safety violations during routine inode access operations.