Executive brief
The Linux kernel's NTFS filesystem driver fails to validate resident attribute lists, allowing an attacker with a crafted NTFS filesystem to trigger out-of-bounds reads of kernel memory. This can lead to information disclosure or system crash, affecting any system that mounts untrusted NTFS volumes.
Technical details
The vulnerability is a buffer over-read in the NTFS filesystem driver's handling of resident attribute lists. The ntfs_read_locked_inode() function copies resident attribute lists into memory without validation, while subsequent code that walks the list (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()) assumes the entries are well-formed and reads fixed-header fields without bounds checking. Additionally, load_attribute_list() itself can over-read the fixed header of truncated trailing entries. The fix introduces ntfs_attr_list_entry_is_valid() to validate each entry's structure before use, and ntfs_attr_list_is_valid() to validate the entire buffer, closing the validation gap on both resident and non-resident paths. No user interaction is required; exploitation occurs automatically upon mounting a malicious NTFS volume.
Affected products
- Linux Linux kernel all versions prior to patched versions
Timeline
- 2026-08-28: disclosed
- 2026-08-28: advisory: CVE-2026-80674