{"id":"CVE-2026-80673","state":"PUBLISHED","title":"ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()\n\nWhen resolving an attribute lookup with a non-zero @lowest_vcn,\nntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to\ndecide whether to keep searching, but bounds that not-yet-validated\nentry only with \"(u8 *)next_al_entry + 6 < al_end\" (which proves just\nbytes 0..6 are in range) and \"(u8 *)next_al_entry + length <= al_end\"\nwith an attacker-controlled, non-8-aligned length. It then reads\nnext_al_entry->lowest_vcn (an __le64 at offset 8) and the name at\nnext_al_entry->name_offset, both of which can lie past al_end -- the\nexact end of the kvmalloc'd attribute-list buffer (allocated at the\non-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST\nwhose last entry sits a few bytes before al_end therefore yields a slab\nout-of-bounds read when the inode is read.\n\nValidate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added\nin patch 1/3) before dereferencing lowest_vcn and the name, so the same\nfixed-header, length and name bounds the main attribute-list walk uses now\nguard this read too.","publishedAt":"2026-08-28T06:49:12.951Z","updatedAt":"2026-08-29T06:22:00.387Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"44885c9b45eb4082fb7f558590d84bb254a08e94","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"344b18f389f9934d59c7b0cf3d20541ea2e0da58","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/attrib.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/attrib.c"]}],"references":["https://git.kernel.org/stable/c/44885c9b45eb4082fb7f558590d84bb254a08e94","https://git.kernel.org/stable/c/344b18f389f9934d59c7b0cf3d20541ea2e0da58"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80673.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80673","state":"PUBLISHED","datePublished":"2026-08-28T06:49:12.951Z","dateUpdated":"2026-08-29T06:22:00.387Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.782Z"},"containers":{"cna":{"title":"ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()\n\nWhen resolving an attribute lookup with a non-zero @lowest_vcn,\nntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to\ndecide whether to keep searching, but bounds that not-yet-validated\nentry only with \"(u8 *)next_al_entry + 6 < al_end\" (which proves just\nbytes 0..6 are in range) and \"(u8 *)next_al_entry + length <= al_end\"\nwith an attacker-controlled, non-8-aligned length. It then reads\nnext_al_entry->lowest_vcn (an __le64 at offset 8) and the name at\nnext_al_entry->name_offset, both of which can lie past al_end -- the\nexact end of the kvmalloc'd attribute-list buffer (allocated at the\non-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST\nwhose last entry sits a few bytes before al_end therefore yields a slab\nout-of-bounds read when the inode is read.\n\nValidate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added\nin patch 1/3) before dereferencing lowest_vcn and the name, so the same\nfixed-header, length and name bounds the main attribute-list walk uses now\nguard this read too."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"44885c9b45eb4082fb7f558590d84bb254a08e94","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"344b18f389f9934d59c7b0cf3d20541ea2e0da58","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/attrib.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/attrib.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/44885c9b45eb4082fb7f558590d84bb254a08e94"},{"url":"https://git.kernel.org/stable/c/344b18f389f9934d59c7b0cf3d20541ea2e0da58"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Classic NTFS registers ntfs_export_ops; remote nfsd/ksmbd VFS reads/lookups on an exported crafted NTFS volume reach ntfs_attr_lookup(lowest_vcn!=0)->ntfs_external_attr_find() without local syscall access on the victim host.\nAC:L - Attacker fully controls on-disk $ATTRIBUTE_LIST tail geometry (short look-ahead entry length/placement); weak bounds let lowest_vcn/name reads pass al_end deterministically on walks with non-zero lowest_vcn, with no race or uncontrollable layout.\nPR:N - Per kernel CNA crafted-filesystem model, exploitation needs only supplying a malicious NTFS image (USB/automount) or read access to mounted/exported NTFS content to trigger extent lookups; no init-namespace root or CAP_SYS_ADMIN on the lookup/read path.\nUI:N - udisks2/systemd automount of removable NTFS and remote NFS/SMB reads on exported volumes reach the vulnerable attribute-list look-ahead during normal file/inode access without the victim deliberately mounting images or performing attacker-specific actions.\nS:U - Slab out-of-bounds read and possible kernel crash stay within the mounting host kernel; this is standard filesystem parsing, not a VM escape, IOMMU bypass, or cross-sandbox scope change.\nC:H - Unvalidated look-ahead reads next_al_entry->lowest_vcn and the Unicode name past the kvmalloc attribute-list end (allocated at exact attr_list_size), disclosing adjacent slab heap memory beyond a few bytes.\nI:H - Attacker-controlled look-ahead entry fields drive kernel parsing of forged attribute-list metadata and adjacent slab contents; per CNA guidance this memory-corruption class can be leveraged for arbitrary kernel modification or control-flow hijack.\nA:H - Slab out-of-bounds read from the attribute-list buffer during inode/extent resolution can access unmapped adjacent memory and oops or panic the kernel, fully denying availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-29T06:22:00.387Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}