GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80674 (GCVE-0-2026-80674)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:22
VLAI
Title
ntfs: validate resident attribute lists and harden the validator
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list() only on the non-resident path; ntfs_read_locked_inode() copies a *resident* attribute list into ni->attr_list with a plain memcpy() and no validation at all. Every subsequent walk of ni->attr_list -- ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and ntfs_attrlist_need() -- then trusts the entries are well-formed and reads attr_list_entry fixed-header fields (lowest_vcn at offset 8, mft_reference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer. load_attribute_list() itself reads ale->name_offset (offset 7), ale->mft_reference (offset 16) and the name length under only an "al < al_start + size" bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes. Factor the per-entry validation into ntfs_attr_list_entry_is_valid(), which requires each entry's fixed header (offsetof(struct attr_list_entry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfs_attr_list_is_valid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in load_attribute_list() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfs_read_locked_inode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 55e97648f7753c6097cb682d24d1abcfe878e812 (git)
Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 7d19e1ffee084c4f7d321a360c14ba43404f7cc8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrib.c",
            "fs/ntfs/attrib.h",
            "fs/ntfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "55e97648f7753c6097cb682d24d1abcfe878e812",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            },
            {
              "lessThan": "7d19e1ffee084c4f7d321a360c14ba43404f7cc8",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrib.c",
            "fs/ntfs/attrib.h",
            "fs/ntfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate resident attribute lists and harden the validator\n\nA base inode\u0027s $ATTRIBUTE_LIST is sanity-checked by load_attribute_list()\nonly on the non-resident path; ntfs_read_locked_inode() copies a *resident*\nattribute list into ni-\u003eattr_list with a plain memcpy() and no validation\nat all. Every subsequent walk of ni-\u003eattr_list --\nntfs_external_attr_find(), ntfs_inode_attach_all_extents() and\nntfs_attrlist_need() -- then trusts the entries are well-formed and reads\nattr_list_entry fixed-header fields\n(lowest_vcn at offset 8, mft_reference at offset 16, and the name) with\nbounds that assume validation already happened. A crafted resident\nattribute list therefore reaches those walks unvalidated and can drive\nout-of-bounds reads of the attribute-list buffer.\n\nload_attribute_list() itself reads ale-\u003ename_offset (offset 7),\nale-\u003emft_reference (offset 16) and the name length under only an\n\"al \u003c al_start + size\" bound, so its own validation loop can over-read the\nfixed header of a truncated trailing entry by a few bytes.\n\nFactor the per-entry validation into ntfs_attr_list_entry_is_valid(),\nwhich requires each entry\u0027s fixed header (offsetof(struct\nattr_list_entry, name)) to be in range before any field is dereferenced,\nthat ale-\u003elength is a multiple of 8 covering the fixed header plus the\nname, and that the entry is in use and carries a live MFT reference.\nntfs_attr_list_is_valid() walks the buffer with it and checks the entries\ntile it exactly. Use the list validator in load_attribute_list()\n(replacing the open-coded loop, closing its own over-read) and on the\nresident path in ntfs_read_locked_inode() (which previously skipped\nvalidation entirely); patches 2/3 reuse the per-entry helper at the other\ntwo attribute-list walks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - NTFS registers ntfs_export_ops; remote nfsd/ksmbd VFS lookups on an exported crafted NTFS volume reach ntfs_iget\u2192ntfs_read_locked_inode and subsequent ntfs_external_attr_find/ntfs_attrlist_need walks without local syscall access.\nAC:L - Attacker fully controls on-disk resident $ATTRIBUTE_LIST entry headers (length, name_offset, mft_reference) in a crafted image; triggering the slab OOB read is deterministic once the inode is accessed with no races.\nPR:N - Exploitation requires only read access to mounted NTFS content (e.g., NFS/SMB client on an exported share) or supplying removable media the host later mounts; the attribute-list walk paths need no init-namespace root or CAP_SYS_ADMIN.\nUI:N - Once a crafted NTFS volume is mounted and exported (or loop-mounted in a user namespace), normal remote lookups/opens or attribute operations reach the unvalidated resident attribute-list parsing without further victim interaction.\nS:U - The out-of-bounds read and potential kernel crash remain within the mounting host kernel security authority; this is standard filesystem metadata parsing, not a VM escape, IOMMU bypass, or sandbox scope change.\nC:H - ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), and ntfs_attrlist_need() read attr_list_entry fixed-header fields (lowest_vcn, mft_reference, name) past the kmalloc attr_list buffer end, disclosing adjacent slab heap memory.\nI:H - Attacker-controlled attribute-list lengths and offsets drive kernel parsing of forged metadata and adjacent slab contents; per kernel CNA guidance this memory-corruption class can be leveraged for arbitrary kernel modification or control-flow hijack beyond the immediate read.\nA:H - Out-of-bounds reads from the attribute-list buffer can fault on invalid adjacent memory or otherwise oops/panic the kernel during inode attribute walks on lookup, extent attach, or attribute-list maintenance paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:01.603Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/55e97648f7753c6097cb682d24d1abcfe878e812"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d19e1ffee084c4f7d321a360c14ba43404f7cc8"
        }
      ],
      "title": "ntfs: validate resident attribute lists and harden the validator",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80674",
    "datePublished": "2026-08-28T06:49:13.549Z",
    "dateReserved": "2026-08-26T14:34:25.782Z",
    "dateUpdated": "2026-08-29T06:22:01.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80674",
      "date": "2026-09-16",
      "epss": "0.00379",
      "percentile": "0.31595"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80674\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:52.700\",\"lastModified\":\"2026-08-29T07:16:49.840\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs: validate resident attribute lists and harden the validator\\n\\nA base inode\u0027s $ATTRIBUTE_LIST is sanity-checked by load_attribute_list()\\nonly on the non-resident path; ntfs_read_locked_inode() copies a *resident*\\nattribute list into ni-\u003eattr_list with a plain memcpy() and no validation\\nat all. Every subsequent walk of ni-\u003eattr_list --\\nntfs_external_attr_find(), ntfs_inode_attach_all_extents() and\\nntfs_attrlist_need() -- then trusts the entries are well-formed and reads\\nattr_list_entry fixed-header fields\\n(lowest_vcn at offset 8, mft_reference at offset 16, and the name) with\\nbounds that assume validation already happened. A crafted resident\\nattribute list therefore reaches those walks unvalidated and can drive\\nout-of-bounds reads of the attribute-list buffer.\\n\\nload_attribute_list() itself reads ale-\u003ename_offset (offset 7),\\nale-\u003emft_reference (offset 16) and the name length under only an\\n\\\"al \u003c al_start + size\\\" bound, so its own validation loop can over-read the\\nfixed header of a truncated trailing entry by a few bytes.\\n\\nFactor the per-entry validation into ntfs_attr_list_entry_is_valid(),\\nwhich requires each entry\u0027s fixed header (offsetof(struct\\nattr_list_entry, name)) to be in range before any field is dereferenced,\\nthat ale-\u003elength is a multiple of 8 covering the fixed header plus the\\nname, and that the entry is in use and carries a live MFT reference.\\nntfs_attr_list_is_valid() walks the buffer with it and checks the entries\\ntile it exactly. Use the list validator in load_attribute_list()\\n(replacing the open-coded loop, closing its own over-read) and on the\\nresident path in ntfs_read_locked_inode() (which previously skipped\\nvalidation entirely); patches 2/3 reuse the per-entry helper at the other\\ntwo attribute-list walks.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs/attrib.c\",\"fs/ntfs/attrib.h\",\"fs/ntfs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\"lessThan\":\"55e97648f7753c6097cb682d24d1abcfe878e812\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\"lessThan\":\"7d19e1ffee084c4f7d321a360c14ba43404f7cc8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs/attrib.c\",\"fs/ntfs/attrib.h\",\"fs/ntfs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/55e97648f7753c6097cb682d24d1abcfe878e812\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d19e1ffee084c4f7d321a360c14ba43404f7cc8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:15:14+00:00",
      "cve": "CVE-2026-80674",
      "id": "CVE-2026-80674",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: validate resident attribute lists and harden the validator",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80674.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-07T16:20:29Z",
      "cve": "CVE-2026-80674",
      "id": "CVE-2026-80674",
      "initial_release_date": "2026-08-28T16:34:30Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80674",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80674.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.