CVE-2026-80674 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate resident attribute lists and harden the validator
A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list() only on the non-resident path; ntfs_read_locked_inode() copies a *resident* attribute list into ni->attr_list with a plain memcpy() and no validation at all. Every subsequent walk of ni->attr_list -- ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and ntfs_attrlist_need() -- then trusts the entries are well-formed and reads attr_list_entry fixed-header fields (lowest_vcn at offset 8, mft_reference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer.
load_attribute_list() itself reads ale->name_offset (offset 7), ale->mft_reference (offset 16) and the name length under only an "al < al_start + size" bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes.
Factor the per-entry validation into ntfs_attr_list_entry_is_valid(), which requires each entry's fixed header (offsetof(struct attr_list_entry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfs_attr_list_is_valid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in load_attribute_list() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfs_read_locked_inode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's NTFS filesystem driver contains a critical input validation flaw within its handling of resident attribute lists, specifically affecting the ntfs_read_locked_inode function. This vulnerability arises because the code path for processing resident attributes bypasses the sanity checks that are applied to non-resident attributes. When an inode is loaded, if it possesses a resident $ATTRIBUTE_LIST, the kernel performs a direct memory copy into the internal data structure without performing any structural validation. This oversight means that malformed or crafted attribute list entries can be accepted and stored in memory with invalid parameters, such as incorrect offsets or lengths, which are not checked against buffer boundaries at this stage.
The operational impact of this flaw is severe, leading to out-of-bounds reads within the kernel space. Subsequent functions that iterate over the attribute list, including ntfs_external_attr_find, ntfs_inode_attach_all_extents, and ntfs_attrlist_need, rely on the assumption that the entries are well-formed based on prior validation. These functions access fixed header fields such as lowest_vcn at offset eight, mft_reference at offset sixteen, and name data without verifying their integrity against the actual buffer size. Consequently, a crafted resident attribute list can cause these functions to read memory beyond the allocated bounds of the attribute-list buffer. This behavior aligns with CWE-125, Out-of-bounds Read, as it allows for unauthorized access to kernel memory which may lead to information disclosure or system instability depending on what data is exposed and how it is processed by subsequent logic.
Furthermore, even the validation function load_attribute_list() exhibits a secondary weakness where its own loop can over-read the fixed header of truncated trailing entries due to insufficient boundary checks during iteration. The vulnerability description indicates that this code reads fields like name_offset at offset seven and mft_reference at offset sixteen under only a basic size bound check, which fails to account for cases where an entry is partially present or malformed in a way that still satisfies the general length constraint but violates specific field offsets. This represents another instance of CWE-125 within the same subsystem, compounding the risk associated with poorly formatted NTFS metadata structures found on mounted volumes or images.
To remediate this issue, the kernel developers have refactored the validation logic into dedicated helper functions named ntfs_attr_list_entry_is_valid and ntfs_attr_list_is_valid. The entry-level validator ensures that each attribute list entry's fixed header is within valid range before any fields are dereferenced. It strictly checks that the length field is a multiple of eight, covering both the fixed header and the name data, and verifies that the entry is in use with a live MFT reference. This granular validation prevents out-of-bounds access by ensuring structural integrity at the individual entry level before higher-level functions utilize the data.
The refactored validator is now applied consistently across all relevant code paths. It replaces the open-coded loop in load_attribute_list, thereby closing its own over-read vulnerability, and is also invoked on the resident path within ntfs_read_locked_inode to address the primary bypass flaw. Additionally, other attribute-list walks reuse this per-entry helper function to ensure uniform validation standards throughout the NTFS driver. This comprehensive approach mitigates the risk of out-of-bounds reads by enforcing strict input validation before any critical data structures are accessed or modified. From a threat modeling perspective, such vulnerabilities in filesystem drivers can be exploited via ATT&CK technique T1556, Modifying Authentication Process, if an attacker controls the storage media and aims to escalate privileges or disrupt service availability through kernel crashes or memory corruption resulting from these out-of-bounds accesses.