GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80598 (GCVE-0-2026-80598)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-30 07:08
VLAI
Title
ntfs3: fix out-of-bounds read in decompress_lznt
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read. Add index bounds checking to prevent the OOB access.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < 1113fa5b01a47a1a4cdbb9c695197ca6215f02a8 (git)
Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < 61415ffa365d2eca6986914afd0d1412444aa1dd (git)
Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < bd77afca2ae9b6d44d37902e3ad672ebb028b070 (git)
Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < c694f8ea2611e7413b3f04ee47e04a9b7b45817b (git)
Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < ff05a98150ebb2b03919a9c05c576681e86abbb7 (git)
Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < a93980141253c932aa6ae5d4422d90e0162dc774 (git)
Affected: 522e010b58379fbe19b38fdef5016bca0c3cf405 , < 7160a57192fb16d7a6fa9b7f5c7ac341d2444a89 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/lznt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1113fa5b01a47a1a4cdbb9c695197ca6215f02a8",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            },
            {
              "lessThan": "61415ffa365d2eca6986914afd0d1412444aa1dd",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            },
            {
              "lessThan": "bd77afca2ae9b6d44d37902e3ad672ebb028b070",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            },
            {
              "lessThan": "c694f8ea2611e7413b3f04ee47e04a9b7b45817b",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            },
            {
              "lessThan": "ff05a98150ebb2b03919a9c05c576681e86abbb7",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            },
            {
              "lessThan": "a93980141253c932aa6ae5d4422d90e0162dc774",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            },
            {
              "lessThan": "7160a57192fb16d7a6fa9b7f5c7ac341d2444a89",
              "status": "affected",
              "version": "522e010b58379fbe19b38fdef5016bca0c3cf405",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/lznt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in decompress_lznt\n\ndecompress_lznt() does not validate array index bounds before accessing\nthe decompression table. A corrupted NTFS3 image with invalid compressed\ndata can trigger an out-of-bounds read.\n\nAdd index bounds checking to prevent the OOB access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - decompress_lznt() is reached only when the kernel reads LZNT-compressed NTFS file data through local VFS paths (read/mmap/write on compressed files) after an ntfs3 mount; it is not invoked from network protocol parsers such as nfsd, ksmbd, or the TCP/IP stack.\nAC:L - Attacker fully controls the on-disk LZNT compressed stream in a crafted file/image and can reliably drive the index past s_max_off[] bounds to trigger the out-of-bounds read; syzbot/syzkaller reproduced this without races or attacker-uncontrollable memory layout.\nPR:L - Triggering decompression requires only read access to a compressed file via open/read/mmap, or mounting a malicious NTFS image which needs CAP_SYS_ADMIN obtainable by unprivileged users inside user+mount namespaces on typical Linux systems.\nUI:N - No separate victim action is required when the attacker has local access: they can mount a crafted NTFS image in a user namespace and read the malicious compressed file themselves to reach decompress_lznt() without anyone else interacting with the system.\nS:U - The flaw corrupts or discloses kernel memory during NTFS LZNT decompression within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries and is not a sandbox or hypervisor escape.\nC:H - The bug performs out-of-bounds reads of kernel memory past the nine-element s_max_off[] table in .rodata, and attacker-controlled index values feed parse_pair() and decompression output, enabling disclosure of sensitive kernel data into page-cache buffers returned to userspace.\nI:H - Unbounded index growth from malformed LZNT input passes attacker-influenced shift widths into parse_pair(), producing malformed backreference offset/length pairs that drive the LZ copy loop and can corrupt kernel page-cache memory in ways chainable toward arbitrary write primitives.\nA:H - Out-of-bounds access to s_max_off[] is a kernel memory safety violation that KASAN/KFENCE report and can oops or panic the kernel; repeated reads of a malicious compressed file can reliably deny service to the reading process or the entire system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-30T07:08:34.000Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1113fa5b01a47a1a4cdbb9c695197ca6215f02a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/61415ffa365d2eca6986914afd0d1412444aa1dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd77afca2ae9b6d44d37902e3ad672ebb028b070"
        },
        {
          "url": "https://git.kernel.org/stable/c/c694f8ea2611e7413b3f04ee47e04a9b7b45817b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff05a98150ebb2b03919a9c05c576681e86abbb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a93980141253c932aa6ae5d4422d90e0162dc774"
        },
        {
          "url": "https://git.kernel.org/stable/c/7160a57192fb16d7a6fa9b7f5c7ac341d2444a89"
        }
      ],
      "title": "ntfs3: fix out-of-bounds read in decompress_lznt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80598",
    "datePublished": "2026-08-28T06:48:24.097Z",
    "dateReserved": "2026-08-26T14:34:25.771Z",
    "dateUpdated": "2026-08-30T07:08:34.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80598",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02911"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-29T01:05:55.000Z",
      "cve": "CVE-2026-80598",
      "id": "msrc_CVE-2026-80598",
      "initial_release_date": "2026-08-29T01:05:55.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ntfs3: fix out-of-bounds read in decompress_lznt",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80598.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80598\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:43.580\",\"lastModified\":\"2026-08-30T07:17:21.197\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs3: fix out-of-bounds read in decompress_lznt\\n\\ndecompress_lznt() does not validate array index bounds before accessing\\nthe decompression table. A corrupted NTFS3 image with invalid compressed\\ndata can trigger an out-of-bounds read.\\n\\nAdd index bounds checking to prevent the OOB access.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs3/lznt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"1113fa5b01a47a1a4cdbb9c695197ca6215f02a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"61415ffa365d2eca6986914afd0d1412444aa1dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"bd77afca2ae9b6d44d37902e3ad672ebb028b070\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"c694f8ea2611e7413b3f04ee47e04a9b7b45817b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"ff05a98150ebb2b03919a9c05c576681e86abbb7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"a93980141253c932aa6ae5d4422d90e0162dc774\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"522e010b58379fbe19b38fdef5016bca0c3cf405\",\"lessThan\":\"7160a57192fb16d7a6fa9b7f5c7ac341d2444a89\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs3/lznt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1113fa5b01a47a1a4cdbb9c695197ca6215f02a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/61415ffa365d2eca6986914afd0d1412444aa1dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7160a57192fb16d7a6fa9b7f5c7ac341d2444a89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a93980141253c932aa6ae5d4422d90e0162dc774\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd77afca2ae9b6d44d37902e3ad672ebb028b070\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c694f8ea2611e7413b3f04ee47e04a9b7b45817b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff05a98150ebb2b03919a9c05c576681e86abbb7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T09:07:31+00:00",
      "cve": "CVE-2026-80598",
      "id": "CVE-2026-80598",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs3: fix out-of-bounds read in decompress_lznt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80598.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:11:00Z",
      "cve": "CVE-2026-80598",
      "id": "CVE-2026-80598",
      "initial_release_date": "2026-08-28T16:36:48Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80598",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80598.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.