CVE-2026-80673

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()

When resolving an attribute lookup with a non-zero @lowest_vcn,

ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to

decide whether to keep searching, but bounds that not-yet-validated

entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just

bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end"

with an attacker-controlled, non-8-aligned length. It then reads

next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at

next_al_entry->name_offset, both of which can lie past al_end -- the

exact end of the kvmalloc'd attribute-list buffer (allocated at the

on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST

whose last entry sits a few bytes before al_end therefore yields a slab

out-of-bounds read when the inode is read.

Validate the look-ahead entry with ntfs_attr_list_entry_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References