CVE-2026-80869

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

The $MFT attribute-list walk in ntfs_read_inode_mount() validates each

entry only with "(u8 *)al_entry + 6 > al_end" and

"(u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end", but then reads

al_entry->lowest_vcn (an __le64 at offset 8) and al_entry->mft_reference

(offset 16) -- fields beyond the 6 bytes proven in range. al_entry->length

is attacker-controlled and only required non-zero, so a short entry (e.g.

length 8) placed at the tail passes both checks while the lowest_vcn /

mft_reference reads fall past al_end.

al_end is ni->attr_list + attr_list_size (the on-disk size); the buffer is

kvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding

usually absorbs the over-read -- but when attr_list_size is a multiple of

SECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an

out-of-bounds read at mount time.

Validat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References