Description
In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix u16 truncation of restart-area length check

ntfs_check_restart_area() validates that the $LogFile restart area and
its trailing log client record array fit within the system page size:

u16 ra_ofs, ra_len, ca_ofs;
...
ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *
sizeof(struct log_client_record);
if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...)
return false;

ra_len is u16, but the right-hand side is computed in size_t
(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients
come straight from the on-disk restart area. With an on-disk
log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and
storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64
gives ra_len 128), so the "fits in the page" check passes even though
the client array described by log_clients extends far beyond the page.

ntfs_check_log_client_array() then walks the array bounded only by the
on-disk log_clients count:

cr = ca + idx;
if (cr->prev_client != LOGFILE_NO_CLIENT) ...

For log_clients 410 it dereferences records up to ca + 409 * 160,
~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an
out-of-bounds read of attacker-controlled extent, reachable when a
crafted NTFS image is mounted (load_and_check_logfile() at mount time).
This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g
userspace driver but never in this revived classic driver.

Compute the restart-area length in a u32 so the existing bounds check
rejects an over-large client array instead of being defeated by the
truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded
from __le16 on-disk fields and every comparison already promotes to
int/size_t, so this changes no result and keeps the declaration uniform.
Published: 2026-08-28
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Out‑of‑Bounds Read leading to potential information disclosure or crash
Action: Patch
AI Analysis

Impact

An incorrect size verification in the Linux kernel NTFS driver causes a 16‑bit counter to wrap when an NTFS volume contains a large client array. The truncation allows the driver to believe a buffer fits within a page while in fact the array extends far beyond the allocation. When the volume is mounted, the driver walks the malformed array and performs an out‑of‑bounds read of attacker‑controlled storage, potentially leaking sensitive data or causing a kernel fault.

Affected Systems

All Linux kernel versions that include the classic NTFS driver without the commit fixing the truncation bug. The patch introduced in commits 07a4751ef3c… and 390936fb15… applies to recent kernel releases; earlier kernels are vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability requires local or privileged access to mount a malicious NTFS image, making it not remotely triggerable via network traffic. It may lead to a kernel fault or leakage of memory contents, setting a moderate potential impact, but overall risk remains low due to the low EPSS and the local‑only attack surface. The vulnerability is not listed in CISA's KEV catalog.

Generated by OpenCVE AI on August 29, 2026 at 09:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch referenced in the advisory (commits 07a4751ef3… and 390936fb15…), which widens the affected variables to 32‑bits to prevent truncation.
  • If a patch cannot be applied immediately, avoid mounting untrusted NTFS volumes or use a read‑only mount to limit the impact of any out‑of‑bounds read.
  • Upgrade the system to a recent kernel that includes the fix to eliminate the vulnerability altogether.

Generated by OpenCVE AI on August 29, 2026 at 09:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 29 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-125

Sat, 29 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Sat, 29 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Fri, 28 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Fri, 28 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Fri, 28 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 ra_ofs, ra_len, ca_ofs; ... ra_len = ca_ofs + le16_to_cpu(ra->log_clients) * sizeof(struct log_client_record); if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...) return false; ra_len is u16, but the right-hand side is computed in size_t (sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients come straight from the on-disk restart area. With an on-disk log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64 gives ra_len 128), so the "fits in the page" check passes even though the client array described by log_clients extends far beyond the page. ntfs_check_log_client_array() then walks the array bounded only by the on-disk log_clients count: cr = ca + idx; if (cr->prev_client != LOGFILE_NO_CLIENT) ... For log_clients 410 it dereferences records up to ca + 409 * 160, ~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an out-of-bounds read of attacker-controlled extent, reachable when a crafted NTFS image is mounted (load_and_check_logfile() at mount time). This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g userspace driver but never in this revived classic driver. Compute the restart-area length in a u32 so the existing bounds check rejects an over-large client array instead of being defeated by the truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded from __le16 on-disk fields and every comparison already promotes to int/size_t, so this changes no result and keeps the declaration uniform.
Title ntfs: fix u16 truncation of restart-area length check
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-29T06:21:59.169Z

Reserved: 2026-08-26T14:34:25.782Z

Link: CVE-2026-80672

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:52.510

Modified: 2026-08-29T07:16:49.610

Link: CVE-2026-80672

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80672 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T09:45:04Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-125

    Out-of-bounds Read