CVE-2026-80869 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
The $MFT attribute-list walk in ntfs_read_inode_mount() validates each entry only with "(u8 *)al_entry + 6 > al_end" and "(u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end", but then reads al_entry->lowest_vcn (an __le64 at offset 8) and al_entry->mft_reference (offset 16) -- fields beyond the 6 bytes proven in range. al_entry->length is attacker-controlled and only required non-zero, so a short entry (e.g. length 8) placed at the tail passes both checks while the lowest_vcn / mft_reference reads fall past al_end.
al_end is ni->attr_list + attr_list_size (the on-disk size); the buffer is kvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding usually absorbs the over-read -- but when attr_list_size is a multiple of SECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an out-of-bounds read at mount time.
Validate the entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing it, matching the bound the other attribute-list walks now use. The validator already requires the length to cover the fixed header, which makes the separate "!al_entry->length" check redundant, so drop it too.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's NTFS filesystem driver contains a critical out-of-bounds read vulnerability within the ntfs_read_inode_mount function, specifically during the processing of the $MFT attribute list. This flaw arises from insufficient boundary validation when iterating through entries in the on-disk metadata structure. The original code performed range checks to ensure that an attribute-list entry did not extend beyond the allocated buffer end by verifying two conditions: first, that the start of the entry plus six bytes remained within bounds, and second, that the entry's length field did not cause it to exceed the buffer limit. However, these validations were inadequate because they only protected access up to offset six, whereas subsequent code accessed fields located at offsets eight and sixteen relative to the entry header. Specifically, the driver reads al_entry->lowest_vcn, a sixty-four-bit little-endian value starting at offset eight, and al_entry->mft_reference, which begins at offset sixteen. Because these memory accesses occur beyond the validated boundary, an attacker who can control the contents of the NTFS volume can trigger out-of-bounds memory reads during the mount operation.
The severity of this vulnerability is heavily influenced by how the kernel allocates memory for the attribute list buffer. The code utilizes kvzalloc to allocate a buffer sized up to the next sector boundary, which typically provides slack space that absorbs minor over-reads without causing immediate system instability or information disclosure. However, when the actual size of the attribute list on disk is an exact multiple of the sector size, no such padding exists. In this specific scenario, crafting a malicious $MFT file with an attribute-list entry where the length field indicates a short but valid-looking structure allows the initial checks to pass while forcing subsequent reads into unmapped or sensitive kernel memory regions. This creates a reliable path for out-of-bounds read exploitation at mount time, potentially leading to information leakage of kernel stack contents or other sensitive data depending on what resides in adjacent memory pages.
From a classification perspective, this vulnerability aligns with CWE-125, which describes an Out-of-Bounds Read condition where software reads past the end of a buffer. The attack vector is classified under ATT&CK technique T1083, File and Directory Discovery, as it involves parsing file system metadata structures that are often accessible to local users or can be introduced via removable media. The root cause lies in improper input validation logic within the filesystem driver's inode mounting routine, where partial boundary checks fail to account for all fields accessed during structure traversal. This represents a classic case of insufficient verification of data boundaries before memory access operations, allowing crafted inputs to bypass security controls embedded in the parsing logic.
The resolution involves implementing comprehensive bounds checking by introducing and utilizing the ntfs_attr_list_entry_is_valid function prior to any dereferencing of attribute-list entries. This validator ensures that the entry length is sufficient to cover not just a minimal header but all fields subsequently accessed, thereby preventing out-of-bounds reads regardless of buffer alignment or size. Additionally, the fix removes redundant checks for non-zero length values since the new validation logic inherently requires the length field to be large enough to encompass the fixed header structure. This change aligns the ntfs_read_inode_mount function with other attribute-list walking routines in the driver that already employ robust validation mechanisms. System administrators and users should apply kernel updates containing this patch immediately, particularly those running NTFS filesystem drivers on systems where untrusted or removable media may be mounted, to mitigate the risk of information disclosure through crafted file system images.