Cloudanix VulnDB

CVE-2026-80869

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Linux can read past the end of its own data structures when it tries to open certain specially made Windows-style drives, which may crash the computer or leak a small amount of memory.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in ntfs_read_inode_mount() when processing a crafted $MFT attribute-list entry whose length field passes minimal checks but does not cover lowest_vcn or mft_reference fields; occurs only when attr_list_size is an exact multiple of SECTOR_SIZE so that kvzalloc rounding provides no slack.

Why it matters to the business

Systems that mount untrusted or attacker-supplied NTFS volumes can experience kernel crashes or limited information disclosure at mount time, disrupting file-system access and requiring reboots or forensic investigation.

How an attack unfolds

An attacker crafts an NTFS image containing a short attribute-list entry placed at the exact end of a sector-sized attr_list buffer. When the victim kernel mounts the image, ntfs_read_inode_mount() performs the insufficient bounds checks, dereferences fields beyond al_end, and triggers an out-of-bounds read.

How to fix it

Apply the upstream kernel patch that replaces the ad-hoc checks with ntfs_attr_list_entry_is_valid() before dereferencing any attribute-list entry; rebuild and deploy the fixed kernel on all affected Linux systems. Disable NTFS support via kernel configuration if the file-system driver is not required.

How to confirm the fix worked

Rebuild a test kernel with the validator in place, attempt to mount a crafted image that previously triggered the over-read, and confirm the mount now fails early with a validation error instead of accessing memory beyond the buffer.

Typical attack path

  1. Construct NTFS volume with malicious attribute-list entry sized to trigger the boundary condition
  2. Deliver the image via USB, network share, or compromised media
  3. Induce the target system to mount the volume (auto-mount, user action, or scripted mount)
  4. Trigger ntfs_read_inode_mount() during $MFT processing
  5. Observe kernel oops, panic, or information leak from the out-of-bounds read

How to detect it

Search kernel logs (dmesg, journalctl) for ntfs_read_inode_mount entries, attribute-list validation failures, or page-fault oopses that occur during mount of NTFS volumes; correlate with unexpected mount attempts of external media.

What your security team should do

  • Immediately schedule kernel updates for any Linux fleet that may mount external NTFS volumes
  • Temporarily block NTFS module loading on high-risk endpoints until patches are applied
  • Add mount-time logging and alerting for NTFS volumes originating from untrusted sources
  • Review and reduce auto-mount policies for removable media

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfs_read_inode_mount() The $MFT attribute-list walk in ntfs_read_inode_mount() validates each entry only with "(u8 *)al_entry + 6 > al_end" and "(u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end", but then reads al_entry->lowest_vcn (an __le64 at offset 8) and al_entry->mft_reference (offset 16) -- fields beyond the 6 bytes proven in range. al_entry->length is attacker-controlled and only required non-zero, so a short entry (e.g. length 8) placed at the tail passes both checks while the lowest_vcn / mft_reference reads fall past al_end. al_end is ni->attr_list + attr_list_size (the on-disk size); the buffer is kvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding usually absorbs the over-read -- but when attr_list_size is a multiple of SECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an out-of-bounds read at mount time. Validate the entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing it, matching the bound the other attribute-list walks now use. The validator already requires the length to cover the fixed header, which makes the separate "!al_entry->length" check redundant, so drop it too.

Affected packages

Ecosystem Package Introduced Fixed