CVE-2026-80673: Linux Kernel NTFS Use-After-Free Vulnerability

CVE-2026-80673 Overview

CVE-2026-80673 is an out-of-bounds read vulnerability in the Linux kernel NTFS file system driver. The flaw resides in ntfs_external_attr_find(), which performs an attribute lookup by peeking at the next $ATTRIBUTE_LIST entry. The look-ahead entry is only partially bounds-checked, allowing reads past the end of the kvmalloc'd attribute-list buffer. A crafted on-disk $ATTRIBUTE_LIST structure triggers a slab out-of-bounds read when the inode is parsed.

Critical Impact
Mounting or reading a maliciously crafted NTFS volume can trigger a slab out-of-bounds read in the kernel, exposing adjacent memory contents and potentially destabilizing the system.

Affected Products

Linux kernel (NTFS file system driver, fs/ntfs)
Distributions shipping vulnerable Linux kernel versions prior to the referenced upstream fixes
Systems mounting untrusted NTFS volumes (removable media, disk images)

Discovery Timeline

2026-08-28 - CVE-2026-80673 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80673

Vulnerability Analysis

The NTFS driver walks the $ATTRIBUTE_LIST structure to resolve attributes that do not fit in the base MFT record. When ntfs_external_attr_find() receives a non-zero @lowest_vcn, it peeks at the next $ATTRIBUTE_LIST entry to decide whether to continue searching. The pre-dereference validation only checks (u8 *)next_al_entry + 6 < al_end, which proves that bytes 0 through 6 of the entry lie within the buffer. A second check, (u8 *)next_al_entry + length <= al_end, relies on an attacker-controlled, non-8-byte-aligned length field.

The function then reads next_al_entry->lowest_vcn, a little-endian 64-bit value at offset 8, and the attribute name at next_al_entry->name_offset. Both accesses can extend past al_end, the precise end of the kvmalloc'd buffer allocated at the on-disk attr_list_size with no rounding.

Root Cause

The root cause is insufficient boundary validation of a not-yet-validated attribute-list entry [CWE-125]. The initial bounds check confirms only the first seven bytes of the entry are addressable, yet the code subsequently dereferences fields at offset 8 and follows an attacker-supplied name_offset. The attacker-controlled length field can be non-aligned and can cover ranges that partially overlap the buffer end, defeating the linear length check.

Attack Vector

An attacker crafts a malicious NTFS file system image where the final $ATTRIBUTE_LIST entry is positioned a few bytes before al_end. When the victim mounts the volume or reads an inode referencing this attribute list, the kernel performs the out-of-bounds slab read. The vulnerability is reachable through any interface that parses attacker-supplied NTFS metadata, including USB media, network-shared disk images, or forensic tooling.

The upstream fix introduces ntfs_attr_list_entry_is_valid() and applies it to the look-ahead entry, enforcing the same fixed-header, length, and name bounds already used by the main attribute-list walk. See the Linux Kernel Commit 344b18f and Linux Kernel Commit 44885c9 for the applied changes.

Detection Methods for CVE-2026-80673

Indicators of Compromise

Kernel oops or KASAN reports referencing ntfs_external_attr_find or ntfs_attr_list_entry_is_valid in the call stack.
Slab out-of-bounds read warnings involving kvmalloc'd buffers during NTFS mount or inode read operations.
Unexpected kernel panics or filesystem errors immediately after mounting removable NTFS media from untrusted sources.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface the out-of-bounds read when parsing suspect NTFS images.
Audit kernel logs (dmesg, journalctl -k) for NTFS parser errors, invalid attribute list entries, or memory access violations correlated with mount events.
Inventory kernel versions across the fleet and flag hosts running pre-patch kernels that permit mounting untrusted NTFS volumes.

Monitoring Recommendations

Monitor mount events (mount, udisksd, automount) for NTFS file systems originating from removable devices or user-writable paths.
Alert on kernel crashes, WARN traces, or KASAN splats referencing NTFS symbols in production telemetry.
Track udev and block-device attach events that precede kernel faults to identify malicious volume delivery.

How to Mitigate CVE-2026-80673

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 344b18f and 44885c9, or install vendor kernel updates that incorporate them.
Restrict mounting of NTFS volumes from untrusted sources, including USB devices and disk images from external parties.
Disable or blacklist the ntfs kernel module on systems that do not require NTFS support.

Patch Information

The fix adds ntfs_attr_list_entry_is_valid() and invokes it against the look-ahead entry in ntfs_external_attr_find() before dereferencing lowest_vcn or the name field. Patches are available in the upstream stable tree via Linux Kernel Commit 344b18f and Linux Kernel Commit 44885c9. Distribution maintainers backport these commits into their supported kernel branches.

Workarounds

Prevent automatic mounting of removable media via desktop environment settings or udev rules.
Use user-space NTFS implementations (such as ntfs-3g via FUSE) instead of the in-kernel driver where operationally acceptable, isolating parsing from the kernel.
Restrict CAP_SYS_ADMIN and mount privileges to trusted administrators to reduce exposure from unprivileged mount vectors.

bash

# Blacklist the in-kernel NTFS module until patched kernels are deployed
echo "blacklist ntfs" | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
echo "blacklist ntfs3" | sudo tee -a /etc/modprobe.d/blacklist-ntfs.conf
sudo update-initramfs -u