CVE-2026-80674: Linux Kernel NTFS Buffer Overflow Vulnerability

CVE-2026-80674 Overview

CVE-2026-80674 is a Linux kernel vulnerability in the NTFS filesystem driver. The flaw resides in how the kernel handles resident $ATTRIBUTE_LIST entries during inode loading. The function ntfs_read_locked_inode() copies a resident attribute list into ni->attr_list using a plain memcpy() without any validation. Subsequent walks of the buffer by ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), and ntfs_attrlist_need() trust the entries and dereference fixed-header fields under assumptions that validation already occurred. A crafted NTFS image can trigger out-of-bounds reads in the attribute-list buffer.

Critical Impact
A malicious NTFS filesystem image can trigger out-of-bounds reads in kernel memory during inode loading, leading to information disclosure or kernel crashes.

Affected Products

Linux kernel NTFS filesystem driver (resident attribute list handling)
load_attribute_list() code path prior to the hardening patch
Systems that mount untrusted NTFS volumes

Discovery Timeline

2026-08-28 - CVE-2026-80674 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80674

Vulnerability Analysis

The Linux kernel's NTFS driver validates $ATTRIBUTE_LIST structures only along the non-resident code path via load_attribute_list(). When the attribute list is stored resident within the MFT record, ntfs_read_locked_inode() performs a straight memcpy() into ni->attr_list with no sanity checks. Downstream code then reads lowest_vcn at offset 8, mft_reference at offset 16, and the entry name using bounds that assume prior validation. This is an Out-of-Bounds Read vulnerability in kernel-mode filesystem parsing.

Root Cause

The root cause is inconsistent validation between the resident and non-resident attribute list paths. Even load_attribute_list() itself reads ale->name_offset (offset 7), ale->mft_reference (offset 16), and the name length under only a weak al < al_start + size bound. A truncated trailing entry can cause the loop to over-read fixed-header bytes beyond the buffer.

Attack Vector

An attacker crafts a malformed NTFS filesystem image with a resident attribute list containing malformed entries. When the volume is mounted and the affected inode is accessed, the kernel walks the unvalidated entries and performs out-of-bounds reads. Attack scenarios include mounting attacker-supplied removable media, mounting disk images in multi-tenant or forensic environments, and automated mount services processing untrusted volumes.

The upstream fix factors per-entry validation into ntfs_attr_list_entry_is_valid(), which requires each entry's fixed header (offsetof(struct attr_list_entry, name)) to be in range before any field is dereferenced. It also enforces that ale->length is a multiple of 8, covers the fixed header plus the name, and that the entry is in use with a live MFT reference. The wrapper ntfs_attr_list_is_valid() walks the buffer and requires the entries to tile it exactly. See the kernel commit 55e97648 and kernel commit 7d19e1ff for the patch details.

Detection Methods for CVE-2026-80674

Indicators of Compromise

Kernel oops or panic messages referencing ntfs_external_attr_find, ntfs_inode_attach_all_extents, ntfs_attrlist_need, or load_attribute_list in dmesg.
KASAN reports of out-of-bounds reads in NTFS attribute-list processing on kernels built with CONFIG_KASAN.
Unexpected mount or filesystem access errors immediately following the insertion of removable media or the attachment of a disk image.

Detection Strategies

Audit mount events for NTFS filesystems from untrusted sources using kernel audit rules on the mount syscall.
Correlate kernel ring-buffer messages with user-session activity to identify volumes that triggered NTFS parsing faults.
Enable KASAN in test or canary environments to catch out-of-bounds reads before deployment.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a central log aggregator and alert on NTFS-related stack traces.
Monitor for repeated automount activity involving removable media on servers and workstations.
Track kernel package versions across the fleet to identify hosts still running vulnerable NTFS drivers.

How to Mitigate CVE-2026-80674

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 55e97648 and 7d19e1ff or install the vendor-supplied stable kernel update that includes them.
Disable automatic mounting of removable media on servers and shared workstations until the patched kernel is deployed.
Restrict which users and services can mount NTFS filesystems, particularly in multi-tenant and forensic workflows.

Patch Information

The fix introduces ntfs_attr_list_entry_is_valid() and ntfs_attr_list_is_valid() to validate resident attribute lists before use. load_attribute_list() replaces its open-coded validation loop with the new helper, and ntfs_read_locked_inode() now validates resident attribute lists on the previously unchecked path. Apply the stable kernel update from your distribution that incorporates kernel commit 55e97648 and kernel commit 7d19e1ff.

Workarounds

Blacklist the ntfs kernel module on hosts that do not require NTFS support.
Configure udev and desktop automount policies to refuse NTFS volumes from untrusted devices.
Require administrator privileges for all NTFS mount operations and log each attempt for review.

bash

# Prevent automatic loading of the ntfs kernel module
echo "blacklist ntfs" | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
sudo update-initramfs -u

# Verify installed kernel version after applying the vendor patch
uname -r