{"id":"CVE-2026-80869","state":"PUBLISHED","title":"ntfs: bound the attribute-list entry in ntfs_read_inode_mount()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the attribute-list entry in ntfs_read_inode_mount()\n\nThe $MFT attribute-list walk in ntfs_read_inode_mount() validates each\nentry only with \"(u8 *)al_entry + 6 > al_end\" and\n\"(u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end\", but then reads\nal_entry->lowest_vcn (an __le64 at offset 8) and al_entry->mft_reference\n(offset 16) -- fields beyond the 6 bytes proven in range. al_entry->length\nis attacker-controlled and only required non-zero, so a short entry (e.g.\nlength 8) placed at the tail passes both checks while the lowest_vcn /\nmft_reference reads fall past al_end.\n\nal_end is ni->attr_list + attr_list_size (the on-disk size); the buffer is\nkvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding\nusually absorbs the over-read -- but when attr_list_size is a multiple of\nSECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an\nout-of-bounds read at mount time.\n\nValidate the entry with ntfs_attr_list_entry_is_valid() (added in patch\n1/3) before dereferencing it, matching the bound the other attribute-list\nwalks now use. The validator already requires the length to cover the fixed\nheader, which makes the separate \"!al_entry->length\" check redundant, so\ndrop it too.","publishedAt":"2026-09-04T16:48:27.068Z","updatedAt":"2026-09-04T16:48:27.068Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"c7a7e48e71ce915ec4cbd6e9f355590c1ecbc29a","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"98634df5b1cb56c26299b7409227025ddb0167d8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/inode.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/inode.c"]}],"references":["https://git.kernel.org/stable/c/c7a7e48e71ce915ec4cbd6e9f355590c1ecbc29a","https://git.kernel.org/stable/c/98634df5b1cb56c26299b7409227025ddb0167d8"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80869.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80869","state":"PUBLISHED","datePublished":"2026-09-04T16:48:27.068Z","dateUpdated":"2026-09-04T16:48:27.068Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.798Z"},"containers":{"cna":{"title":"ntfs: bound the attribute-list entry in ntfs_read_inode_mount()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the attribute-list entry in ntfs_read_inode_mount()\n\nThe $MFT attribute-list walk in ntfs_read_inode_mount() validates each\nentry only with \"(u8 *)al_entry + 6 > al_end\" and\n\"(u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end\", but then reads\nal_entry->lowest_vcn (an __le64 at offset 8) and al_entry->mft_reference\n(offset 16) -- fields beyond the 6 bytes proven in range. al_entry->length\nis attacker-controlled and only required non-zero, so a short entry (e.g.\nlength 8) placed at the tail passes both checks while the lowest_vcn /\nmft_reference reads fall past al_end.\n\nal_end is ni->attr_list + attr_list_size (the on-disk size); the buffer is\nkvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding\nusually absorbs the over-read -- but when attr_list_size is a multiple of\nSECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an\nout-of-bounds read at mount time.\n\nValidate the entry with ntfs_attr_list_entry_is_valid() (added in patch\n1/3) before dereferencing it, matching the bound the other attribute-list\nwalks now use. The validator already requires the length to cover the fixed\nheader, which makes the separate \"!al_entry->length\" check redundant, so\ndrop it too."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"c7a7e48e71ce915ec4cbd6e9f355590c1ecbc29a","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"98634df5b1cb56c26299b7409227025ddb0167d8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/inode.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/inode.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c7a7e48e71ce915ec4cbd6e9f355590c1ecbc29a"},{"url":"https://git.kernel.org/stable/c/98634df5b1cb56c26299b7409227025ddb0167d8"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-09-04T16:48:27.068Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}