CVE-2026-80674 - Vulnerability Details

- ntfs: validate resident attribute lists and harden the validator

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate resident attribute lists and harden the validator

A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list()
only on the non-resident path; ntfs_read_locked_inode() copies a *resident*
attribute list into ni->attr_list with a plain memcpy() and no validation
at all. Every subsequent walk of ni->attr_list --
ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and
ntfs_attrlist_need() -- then trusts the entries are well-formed and reads
attr_list_entry fixed-header fields
(lowest_vcn at offset 8, mft_reference at offset 16, and the name) with
bounds that assume validation already happened. A crafted resident
attribute list therefore reaches those walks unvalidated and can drive
out-of-bounds reads of the attribute-list buffer.

load_attribute_list() itself reads ale->name_offset (offset 7),
ale->mft_reference (offset 16) and the name length under only an
"al < al_start + size" bound, so its own validation loop can over-read the
fixed header of a truncated trailing entry by a few bytes.

Factor the per-entry validation into ntfs_attr_list_entry_is_valid(),
which requires each entry's fixed header (offsetof(struct
attr_list_entry, name)) to be in range before any field is dereferenced,
that ale->length is a multiple of 8 covering the fixed header plus the
name, and that the entry is in use and carries a live MFT reference.
ntfs_attr_list_is_valid() walks the buffer with it and checks the entries
tile it exactly. Use the list validator in load_attribute_list()
(replacing the open-coded loop, closing its own over-read) and on the
resident path in ntfs_read_locked_inode() (which previously skipped
validation entirely); patches 2/3 reuse the per-entry helper at the other
two attribute-list walks.

Published: 2026-08-28

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the Linux kernel’s NTFS filesystem driver. A resident attribute list is copied into the kernel using a simple memcpy with no validation. Subsequent walk functions assume list is well‑formed and read header fields with bounds based on a prior validation step. Because the resident path bypasses that validation, a crafted attribute list can cause out‑of‑bounds reads of kernel memory.

Affected Systems

All Linux kernel implementations that include the legacy ntfs.c module and have not integrated the fix commits referenced in the advisory. Any system that mounts NTFS filesystems via the kernel driver is affected; this includes recent kernel releases lacking the patch.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% shows a low probability of exploitation. It is not listed in CISA KEV. Based on the description, it is inferred that the attacker must have the ability to mount an NTFS volume that contains a malicious resident attribute list. This triggers out‑of‑bounds reads of the attribute‑list buffer, accessing kernel memory. No additional attack steps are detailed in the supplied information.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1e9ea7e04472d4e5e12e58c881eaacfb3e49b669`	affected	< 55e97648f7753c6097cb682d24d1abcfe878e812
`1e9ea7e04472d4e5e12e58c881eaacfb3e49b669`	affected	< 7d19e1ffee084c4f7d321a360c14ba43404f7cc8

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1e9ea7e04472d4e5e12e58c881eaacfb3e49b669,55e97648f7753c6097cb682d24d1abcfe878e812)`	affected	code_commit	—
`[1e9ea7e04472d4e5e12e58c881eaacfb3e49b669,7d19e1ffee084c4f7d321a360c14ba43404f7cc8)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that incorporates the NTFS driver fix (see the referenced commit hashes in the advisory).
If a kernel upgrade is not feasible, unload or blacklist the ntfs kernel module to eliminate the vulnerable code path.
For environments requiring NTFS support, use the userspace NTFS‑3g driver instead of the kernel driver or restrict NTFS mount permissions to trusted users and processes.

Generated by OpenCVE AI on August 31, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00379.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/55e97648f7753c6097cb682d24d1abcfe878e812
https://git.kernel.org/stable/c/7d19e1ffee084c4f7d321a360c14ba43404f7cc8
https://lore.kernel.org/linux-cve-announce/2026082849-CVE-2026-80674-6c4d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80674
https://www.cve.org/CVERecord?id=CVE-2026-80674

History

Mon, 31 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Mon, 31 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026082849-CVE-2026-80674-6c4d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80674 https://www.cve.org/CVERecord?id=CVE-2026-80674
Metrics	threat_severity `None`	threat_severity `Moderate`

Sat, 29 Aug 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Sat, 29 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-126 CWE-20

Sat, 29 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 28 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-126 CWE-20

Fri, 28 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-126 CWE-20

Fri, 28 Aug 2026 10:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-126 CWE-20

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list() only on the non-resident path; ntfs_read_locked_inode() copies a resident attribute list into ni->attr_list with a plain memcpy() and no validation at all. Every subsequent walk of ni->attr_list -- ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and ntfs_attrlist_need() -- then trusts the entries are well-formed and reads attr_list_entry fixed-header fields (lowest_vcn at offset 8, mft_reference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer. load_attribute_list() itself reads ale->name_offset (offset 7), ale->mft_reference (offset 16) and the name length under only an "al < al_start + size" bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes. Factor the per-entry validation into ntfs_attr_list_entry_is_valid(), which requires each entry's fixed header (offsetof(struct attr_list_entry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfs_attr_list_is_valid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in load_attribute_list() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfs_read_locked_inode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.
Title		ntfs: validate resident attribute lists and harden the validator
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/55e97648f7753c6097cb682d24d1abcfe878e812 https://git.kernel.org/stable/c/7d19e1ffee084c4f7d321a360c14ba43404f7cc8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:49:13.549Z

Updated: 2026-08-29T06:22:01.603Z

Reserved: 2026-08-26T14:34:25.782Z

Link: CVE-2026-80674

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:52.700

Modified: 2026-08-29T07:16:49.840

Link: CVE-2026-80674

Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80674 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-31T16:30:05Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object