CVE-2026-80598: Linux Kernel NTFS3 Buffer Overflow Vulnerability

CVE-2026-80598 Overview

CVE-2026-80598 is an out-of-bounds read vulnerability in the Linux kernel's ntfs3 filesystem driver. The flaw resides in the decompress_lznt() function, which fails to validate array index bounds before accessing the decompression table. A crafted NTFS3 filesystem image containing invalid compressed data can trigger the out-of-bounds read when mounted or processed by the kernel. The upstream fix adds index bounds checking to prevent the OOB access.

Critical Impact
A local attacker able to supply a malicious NTFS3 image can trigger kernel-mode out-of-bounds reads, leading to information disclosure, denial of service, or potential exploitation chains against kernel memory.

Affected Products

Linux kernel — ntfs3 filesystem driver (upstream, multiple stable branches)
Distributions shipping vulnerable kernel versions with ntfs3 enabled
Systems that mount user-supplied NTFS volumes (removable media, disk images, containers)

Discovery Timeline

2026-08-28 - CVE-2026-80598 published to NVD
2026-08-30 - Last updated in NVD database

Technical Details for CVE-2026-80598

Vulnerability Analysis

The ntfs3 driver in the Linux kernel implements read/write support for Microsoft NTFS volumes, including LZNT1 decompression for compressed files. The decompress_lznt() routine walks compressed chunks and consults an internal decompression table to reconstruct plaintext data. The function accesses table entries using indices derived from untrusted on-disk metadata without verifying the index against the table's size.

When a corrupted or maliciously crafted NTFS3 image is processed, an attacker-controlled value can steer the index outside the valid range of the decompression table. The kernel then dereferences memory adjacent to the table, producing an out-of-bounds read within kernel address space [CWE-125]. Depending on the surrounding allocation, this may leak sensitive kernel data, corrupt decompression state, or destabilize the mount operation.

Root Cause

The root cause is missing input validation on an index used to look up entries in the LZNT decompression table inside decompress_lznt(). The routine trusted values decoded from on-disk compressed data and used them as array indices without checking upper bounds. The upstream patch series adds explicit bounds checks before each affected table access.

Attack Vector

Exploitation requires local access with the ability to introduce an NTFS3 image to the target system. Common paths include inserting removable media, attaching a crafted disk image, or providing a malicious filesystem inside a container or virtual machine. Automatic mount daemons that handle removable devices increase exposure by processing untrusted filesystems without user interaction beyond device insertion.

No verified public exploit code is available. Technical details of the fix are documented in the kernel change log entries: Kernel commit 1113fa5b, Kernel commit 61415ffa, Kernel commit 7160a571, Kernel commit a9398014, Kernel commit bd77afca, Kernel commit c694f8ea, and Kernel commit ff05a981.

Detection Methods for CVE-2026-80598

Indicators of Compromise

Kernel oops, KASAN reports, or BUG: messages referencing decompress_lznt or ntfs3 in dmesg and journal logs.
Unexpected mount attempts of NTFS3 volumes from removable media or user-supplied images on systems that do not normally use NTFS.
Repeated failed mount operations targeting the ntfs3 filesystem type in audit logs.

Detection Strategies

Enable KASAN on test kernels to catch out-of-bounds reads in ntfs3 code paths during fuzzing or triage.
Alert on mount syscalls specifying -t ntfs3 from non-administrative contexts or automount services handling removable devices.
Correlate kernel warning messages containing ntfs3 with the user session and device that supplied the source image.

Monitoring Recommendations

Ship kernel ring-buffer logs and audit records to a central platform and alert on ntfs3 fault signatures.
Track running kernel versions across the fleet and flag hosts still on pre-patch builds.
Monitor removable-media insertion events on servers and workstations that should not process external filesystems.

How to Mitigate CVE-2026-80598

Immediate Actions Required

Apply the vendor kernel update that includes the decompress_lznt bounds-check patch on all affected systems.
Disable automatic mounting of removable media on servers and high-value workstations until patched.
Restrict which users and services may invoke mount with the ntfs3 filesystem type.

Patch Information

The fix adds index bounds checking in decompress_lznt() before accessing the decompression table. It is distributed across multiple stable branches via the kernel change log entries listed in the Attack Vector section. Rebuild or install a distribution kernel that incorporates these commits, then reboot to activate the patched image.

Workarounds

Blacklist the ntfs3 kernel module on hosts that do not require NTFS support using /etc/modprobe.d/ configuration.
Configure udisks2 and desktop automount policies to refuse NTFS volumes from untrusted devices.
Process untrusted NTFS images inside isolated virtual machines rather than on production hosts.

bash

# Prevent the vulnerable module from loading on hosts that do not need NTFS3
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf
echo 'install ntfs3 /bin/true' | sudo tee -a /etc/modprobe.d/disable-ntfs3.conf
sudo depmod -a

# Verify the module is not currently loaded
lsmod | grep -i ntfs3

# Confirm running kernel version matches a patched build
uname -r