CVE-2026-80672: Linux Kernel NTFS Buffer Overflow Vulnerability

CVE-2026-80672 Overview

CVE-2026-80672 is an out-of-bounds read vulnerability in the Linux kernel's revived classic NTFS driver. The flaw lives in ntfs_check_restart_area(), where a u16 variable truncates the computed length of the $LogFile restart-area client array. A crafted NTFS image with an inflated log_clients count defeats the page-size bounds check through integer wraparound. When the image is mounted, ntfs_check_log_client_array() then walks attacker-controlled records past the kvzalloc(system_page_size) buffer. This is the in-kernel analogue of CVE-2022-30789, which was previously fixed only in the ntfs-3g userspace driver.

Critical Impact
A local user who can mount a malicious NTFS image triggers an out-of-bounds read of roughly 64 KiB past the restart-page buffer, exposing adjacent kernel memory and risking kernel integrity.

Affected Products

Linux kernel versions containing the revived classic ntfs (read-write) driver
Distributions shipping the affected fs/ntfs3 restart-log parsing code prior to the fix
Systems permitting mounting of untrusted NTFS filesystem images

Discovery Timeline

2026-08-28 - CVE-2026-80672 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80672

Vulnerability Analysis

The vulnerability is a numeric truncation error [CWE-197] leading to an out-of-bounds read [CWE-125] in the Linux kernel NTFS driver. ntfs_check_restart_area() declares ra_ofs, ra_len, and ca_ofs as u16 values. It then computes ra_len = ca_ofs + le16_to_cpu(ra->log_clients) * sizeof(struct log_client_record).

Because sizeof(struct log_client_record) is 160, the multiplication is evaluated in size_t. Storing the result into a u16 truncates modulo 65536. With an on-disk log_clients value of 410, the product 410 * 160 = 65600 collapses to 64 once assigned to ra_len (before adding ca_ofs). The subsequent check ra_ofs + ra_len > system_page_size incorrectly passes.

ntfs_check_log_client_array() then iterates using the raw on-disk log_clients count as its bound. For log_clients = 410, it dereferences records up to ca + 409 * 160, roughly 64 KiB beyond the allocated restart-page buffer. The read spans attacker-influenced kernel memory adjacent to the allocation.

Root Cause

The root cause is unsafe narrowing arithmetic on values sourced directly from an untrusted on-disk structure. The bounds check operates on a truncated length rather than the true product. The upstream fix widens ra_len, ra_ofs, and ca_ofs to u32 so the existing comparison rejects oversized client arrays instead of being bypassed by wraparound.

Attack Vector

Exploitation requires a local attacker with the ability to mount a crafted NTFS image. load_and_check_logfile() invokes the vulnerable path at mount time. On systems where automounting of removable media is enabled, or where unprivileged users can supply filesystem images, the attack surface expands accordingly. See the upstream commits for the exact code paths: kernel.org commit 07a4751e and kernel.org commit 390936fb.

No public proof-of-concept for CVE-2026-80672 is currently listed, and the vulnerability is not on the CISA KEV list.

Detection Methods for CVE-2026-80672

Indicators of Compromise

Kernel log entries referencing ntfs_check_restart_area or ntfs_check_log_client_array failures near mount events
Unexpected mount attempts of NTFS images from user-writable paths or removable media
KASAN or slab-out-of-bounds splats originating from NTFS $LogFile parsing

Detection Strategies

Monitor mount syscalls for NTFS filesystem types initiated by non-administrative users or automounters
Enable KASAN on test kernels to surface the out-of-bounds read during triage of suspect images
Alert on kernel oops or warning traces containing NTFS log-file functions in dmesg or journald

Monitoring Recommendations

Ingest kernel audit logs and mount events into a centralized log platform for correlation with USB or image-file activity
Track kernel version inventory to identify hosts still running the vulnerable NTFS driver
Correlate filesystem mount events with the user context and source device to spot untrusted images

How to Mitigate CVE-2026-80672

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git tree as soon as vendor builds are available
Disable automatic mounting of NTFS filesystems from removable media on servers and multi-user hosts
Restrict which users can invoke mount on arbitrary filesystem images, including within containers and sandboxes

Patch Information

The fix widens ra_len, ra_ofs, and ca_ofs to u32 so the page-size bounds check operates on the untruncated length. The change is available in the upstream Linux stable tree via commit 07a4751e and commit 390936fb. Rebuild and deploy distribution kernels that incorporate these commits.

Workarounds

Blacklist the classic ntfs kernel module on systems that do not require NTFS read-write support
Prefer ntfs-3g FUSE mounts or read-only access where the vulnerable in-kernel driver cannot be removed
Enforce noauto and administrator-only mount policies for NTFS volumes until patched kernels are deployed

bash

# Prevent loading of the vulnerable classic NTFS driver
echo 'blacklist ntfs' | sudo tee /etc/modprobe.d/disable-ntfs.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep -E '^ntfs\b' || echo 'ntfs module not loaded'