GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80672 (GCVE-0-2026-80672)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:21
VLAI
Title
ntfs: fix u16 truncation of restart-area length check
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 ra_ofs, ra_len, ca_ofs; ... ra_len = ca_ofs + le16_to_cpu(ra->log_clients) * sizeof(struct log_client_record); if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...) return false; ra_len is u16, but the right-hand side is computed in size_t (sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients come straight from the on-disk restart area. With an on-disk log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64 gives ra_len 128), so the "fits in the page" check passes even though the client array described by log_clients extends far beyond the page. ntfs_check_log_client_array() then walks the array bounded only by the on-disk log_clients count: cr = ca + idx; if (cr->prev_client != LOGFILE_NO_CLIENT) ... For log_clients 410 it dereferences records up to ca + 409 * 160, ~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an out-of-bounds read of attacker-controlled extent, reachable when a crafted NTFS image is mounted (load_and_check_logfile() at mount time). This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g userspace driver but never in this revived classic driver. Compute the restart-area length in a u32 so the existing bounds check rejects an over-large client array instead of being defeated by the truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded from __le16 on-disk fields and every comparison already promotes to int/size_t, so this changes no result and keeps the declaration uniform.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 07a4751ef3ccc8bfd17bfbb16e5003c03161790d (git)
Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 390936fb15053d8d8991ca3a22776e251a5a7f2f (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/logfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07a4751ef3ccc8bfd17bfbb16e5003c03161790d",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            },
            {
              "lessThan": "390936fb15053d8d8991ca3a22776e251a5a7f2f",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/logfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix u16 truncation of restart-area length check\n\nntfs_check_restart_area() validates that the $LogFile restart area and\nits trailing log client record array fit within the system page size:\n\n        u16 ra_ofs, ra_len, ca_ofs;\n        ...\n        ra_len = ca_ofs + le16_to_cpu(ra-\u003elog_clients) *\n                        sizeof(struct log_client_record);\n        if (ra_ofs + ra_len \u003e le32_to_cpu(rp-\u003esystem_page_size) || ...)\n                return false;\n\nra_len is u16, but the right-hand side is computed in size_t\n(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients\ncome straight from the on-disk restart area. With an on-disk\nlog_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and\nstoring into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64\ngives ra_len 128), so the \"fits in the page\" check passes even though\nthe client array described by log_clients extends far beyond the page.\n\nntfs_check_log_client_array() then walks the array bounded only by the\non-disk log_clients count:\n\n        cr = ca + idx;\n        if (cr-\u003eprev_client != LOGFILE_NO_CLIENT) ...\n\nFor log_clients 410 it dereferences records up to ca + 409 * 160,\n~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an\nout-of-bounds read of attacker-controlled extent, reachable when a\ncrafted NTFS image is mounted (load_and_check_logfile() at mount time).\nThis is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g\nuserspace driver but never in this revived classic driver.\n\nCompute the restart-area length in a u32 so the existing bounds check\nrejects an over-large client array instead of being defeated by the\ntruncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded\nfrom __le16 on-disk fields and every comparison already promotes to\nint/size_t, so this changes no result and keeps the declaration uniform."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only when the in-kernel NTFS driver parses $LogFile metadata during a local block-device or loopback mount (ntfs_fill_super \u2192 load_and_check_logfile); it is not triggered by network packet handling, ksmbd, nfsd, or remote file I/O on an already-mounted volume.\nAC:L - An attacker fully controls on-disk restart-area fields (log_clients, client_array_offset, client lists); values such as log_clients=410 reliably defeat the u16 length truncation and force ntfs_check_log_client_array() to walk far beyond the allocated restart-page buffer.\nPR:L - Exploitation requires mounting a crafted NTFS image, which unprivileged users can do via user namespaces (CAP_SYS_ADMIN in a new userns) and loop/fsopen/fsmount without init-namespace root; it is not a pre-auth network service path.\nUI:N - No victim interaction is required when the attacker mounts their own crafted image (e.g., loop device in a user namespace); the malicious $LogFile metadata is consumed automatically at mount time before any separate file access.\nS:C - A guest, container tenant, or external party can embed the malicious $LogFile in a disk image that crosses into the host/examiner security domain when an administrator or automated tooling mounts that NTFS volume on the host kernel, escaping the source disk\u0027s trust boundary.\nC:H - ntfs_check_log_client_array() performs an out-of-bounds read of roughly 64 KiB past a system_page_size kvzalloc buffer, disclosing adjacent kernel heap/slab memory rather than being limited to a few bytes of bounded leakage.\nI:H - Large kernel heap out-of-bounds reads of attacker-influenced extent and adjacent objects are memory-corruption primitives that can be groomed into arbitrary write or code-execution chains, matching the impact class of the analogous CVE-2022-30789 log-client-array bug.\nA:H - Dereferencing client records ~64 KiB beyond a single-page allocation is very likely to touch unmapped pages or corrupt adjacent kernel structures, producing kernel oops/panic or hang during mount-time logfile validation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:59.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07a4751ef3ccc8bfd17bfbb16e5003c03161790d"
        },
        {
          "url": "https://git.kernel.org/stable/c/390936fb15053d8d8991ca3a22776e251a5a7f2f"
        }
      ],
      "title": "ntfs: fix u16 truncation of restart-area length check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80672",
    "datePublished": "2026-08-28T06:49:12.340Z",
    "dateReserved": "2026-08-26T14:34:25.782Z",
    "dateUpdated": "2026-08-29T06:21:59.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80672",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02118"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80672\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:52.510\",\"lastModified\":\"2026-08-29T07:16:49.610\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs: fix u16 truncation of restart-area length check\\n\\nntfs_check_restart_area() validates that the $LogFile restart area and\\nits trailing log client record array fit within the system page size:\\n\\n        u16 ra_ofs, ra_len, ca_ofs;\\n        ...\\n        ra_len = ca_ofs + le16_to_cpu(ra-\u003elog_clients) *\\n                        sizeof(struct log_client_record);\\n        if (ra_ofs + ra_len \u003e le32_to_cpu(rp-\u003esystem_page_size) || ...)\\n                return false;\\n\\nra_len is u16, but the right-hand side is computed in size_t\\n(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients\\ncome straight from the on-disk restart area. With an on-disk\\nlog_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and\\nstoring into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64\\ngives ra_len 128), so the \\\"fits in the page\\\" check passes even though\\nthe client array described by log_clients extends far beyond the page.\\n\\nntfs_check_log_client_array() then walks the array bounded only by the\\non-disk log_clients count:\\n\\n        cr = ca + idx;\\n        if (cr-\u003eprev_client != LOGFILE_NO_CLIENT) ...\\n\\nFor log_clients 410 it dereferences records up to ca + 409 * 160,\\n~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an\\nout-of-bounds read of attacker-controlled extent, reachable when a\\ncrafted NTFS image is mounted (load_and_check_logfile() at mount time).\\nThis is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g\\nuserspace driver but never in this revived classic driver.\\n\\nCompute the restart-area length in a u32 so the existing bounds check\\nrejects an over-large client array instead of being defeated by the\\ntruncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded\\nfrom __le16 on-disk fields and every comparison already promotes to\\nint/size_t, so this changes no result and keeps the declaration uniform.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs/logfile.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\"lessThan\":\"07a4751ef3ccc8bfd17bfbb16e5003c03161790d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\"lessThan\":\"390936fb15053d8d8991ca3a22776e251a5a7f2f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs/logfile.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07a4751ef3ccc8bfd17bfbb16e5003c03161790d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/390936fb15053d8d8991ca3a22776e251a5a7f2f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T10:52:09+00:00",
      "cve": "CVE-2026-80672",
      "id": "CVE-2026-80672",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: fix u16 truncation of restart-area length check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80672.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:27:22Z",
      "cve": "CVE-2026-80672",
      "id": "CVE-2026-80672",
      "initial_release_date": "2026-08-28T16:34:35Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80672",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80672.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.