CVE-2026-80673 (GCVE-0-2026-80673)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:22
VLAI
Title
ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read. Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 44885c9b45eb4082fb7f558590d84bb254a08e94 (git)
Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 344b18f389f9934d59c7b0cf3d20541ea2e0da58 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44885c9b45eb4082fb7f558590d84bb254a08e94",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            },
            {
              "lessThan": "344b18f389f9934d59c7b0cf3d20541ea2e0da58",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()\n\nWhen resolving an attribute lookup with a non-zero @lowest_vcn,\nntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to\ndecide whether to keep searching, but bounds that not-yet-validated\nentry only with \"(u8 *)next_al_entry + 6 \u003c al_end\" (which proves just\nbytes 0..6 are in range) and \"(u8 *)next_al_entry + length \u003c= al_end\"\nwith an attacker-controlled, non-8-aligned length. It then reads\nnext_al_entry-\u003elowest_vcn (an __le64 at offset 8) and the name at\nnext_al_entry-\u003ename_offset, both of which can lie past al_end -- the\nexact end of the kvmalloc\u0027d attribute-list buffer (allocated at the\non-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST\nwhose last entry sits a few bytes before al_end therefore yields a slab\nout-of-bounds read when the inode is read.\n\nValidate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added\nin patch 1/3) before dereferencing lowest_vcn and the name, so the same\nfixed-header, length and name bounds the main attribute-list walk uses now\nguard this read too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Classic NTFS registers ntfs_export_ops; remote nfsd/ksmbd VFS reads/lookups on an exported crafted NTFS volume reach ntfs_attr_lookup(lowest_vcn!=0)-\u003entfs_external_attr_find() without local syscall access on the victim host.\nAC:L - Attacker fully controls on-disk $ATTRIBUTE_LIST tail geometry (short look-ahead entry length/placement); weak bounds let lowest_vcn/name reads pass al_end deterministically on walks with non-zero lowest_vcn, with no race or uncontrollable layout.\nPR:N - Per kernel CNA crafted-filesystem model, exploitation needs only supplying a malicious NTFS image (USB/automount) or read access to mounted/exported NTFS content to trigger extent lookups; no init-namespace root or CAP_SYS_ADMIN on the lookup/read path.\nUI:N - udisks2/systemd automount of removable NTFS and remote NFS/SMB reads on exported volumes reach the vulnerable attribute-list look-ahead during normal file/inode access without the victim deliberately mounting images or performing attacker-specific actions.\nS:U - Slab out-of-bounds read and possible kernel crash stay within the mounting host kernel; this is standard filesystem parsing, not a VM escape, IOMMU bypass, or cross-sandbox scope change.\nC:H - Unvalidated look-ahead reads next_al_entry-\u003elowest_vcn and the Unicode name past the kvmalloc attribute-list end (allocated at exact attr_list_size), disclosing adjacent slab heap memory beyond a few bytes.\nI:H - Attacker-controlled look-ahead entry fields drive kernel parsing of forged attribute-list metadata and adjacent slab contents; per CNA guidance this memory-corruption class can be leveraged for arbitrary kernel modification or control-flow hijack.\nA:H - Slab out-of-bounds read from the attribute-list buffer during inode/extent resolution can access unmapped adjacent memory and oops or panic the kernel, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:00.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44885c9b45eb4082fb7f558590d84bb254a08e94"
        },
        {
          "url": "https://git.kernel.org/stable/c/344b18f389f9934d59c7b0cf3d20541ea2e0da58"
        }
      ],
      "title": "ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80673",
    "datePublished": "2026-08-28T06:49:12.951Z",
    "dateReserved": "2026-08-26T14:34:25.782Z",
    "dateUpdated": "2026-08-29T06:22:00.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80673",
      "date": "2026-09-22",
      "epss": "0.00379",
      "percentile": "0.31825"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/attrib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "44885c9b45eb4082fb7f558590d84bb254a08e94",
                    "status": "affected",
                    "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "344b18f389f9934d59c7b0cf3d20541ea2e0da58",
                    "status": "affected",
                    "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/attrib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()\n\nWhen resolving an attribute lookup with a non-zero @lowest_vcn,\nntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to\ndecide whether to keep searching, but bounds that not-yet-validated\nentry only with \"(u8 *)next_al_entry + 6 \u003c al_end\" (which proves just\nbytes 0..6 are in range) and \"(u8 *)next_al_entry + length \u003c= al_end\"\nwith an attacker-controlled, non-8-aligned length. It then reads\nnext_al_entry-\u003elowest_vcn (an __le64 at offset 8) and the name at\nnext_al_entry-\u003ename_offset, both of which can lie past al_end -- the\nexact end of the kvmalloc\u0027d attribute-list buffer (allocated at the\non-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST\nwhose last entry sits a few bytes before al_end therefore yields a slab\nout-of-bounds read when the inode is read.\n\nValidate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added\nin patch 1/3) before dereferencing lowest_vcn and the name, so the same\nfixed-header, length and name bounds the main attribute-list walk uses now\nguard this read too."
          }
        ],
        "id": "CVE-2026-80673",
        "lastModified": "2026-08-29T07:16:49.730",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:52.607",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/344b18f389f9934d59c7b0cf3d20541ea2e0da58"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/44885c9b45eb4082fb7f558590d84bb254a08e94"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T06:47:42+00:00",
      "cve": "CVE-2026-80673",
      "id": "CVE-2026-80673",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80673.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-07T16:20:31Z",
      "cve": "CVE-2026-80673",
      "id": "CVE-2026-80673",
      "initial_release_date": "2026-08-28T16:34:33Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80673",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80673.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.