CVE-2026-80868: Linux Kernel NTFS3 Buffer Overflow Vulnerability

CVE-2026-80868 Overview

CVE-2026-80868 is a Linux kernel vulnerability in the ntfs3 filesystem driver. The flaw resides in how the driver allocates iomapinline_data buffers using kmemdup. Because kmemdup does not guarantee page-aligned memory, the iomap_inline_data_valid check in iomap_write_end_inline can fail, triggering a kernel BUG. The upstream fix switches the allocation to alloc_page so the inline data is always page-aligned. The issue affects systems mounting NTFS volumes via the in-kernel ntfs3 driver.

Critical Impact
A crafted or unlucky NTFS inline-data write path can trigger a kernel BUG_ON, resulting in a denial of service through kernel panic on affected hosts.

Affected Products

Linux kernel ntfs3 filesystem driver
Stable kernel branches referenced in commits 3cd2212 and 70d3855
Linux distributions shipping the vulnerable ntfs3 code path

Discovery Timeline

2026-09-04 - CVE-2026-80868 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80868

Vulnerability Analysis

The ntfs3 driver supports storing small file contents inline within the file's metadata rather than in separate data blocks. When the iomap layer processes writes to inline data, iomap_write_end_inline invokes iomap_inline_data_valid to confirm the inline buffer fits entirely within a single memory page. This check assumes the backing allocation is page-aligned.

The original ntfs3 implementation allocated the inline buffer with kmemdup, which returns memory from the general slab allocator. Slab allocations for sub-page objects are not required to sit on a page boundary. When the returned pointer straddles a page boundary, the validity check fails and the kernel triggers a BUG in the iomap write completion path, halting the affected CPU or the system.

Root Cause

The root cause is an allocator mismatch between the ntfs3 inline-data path and the iomap layer's alignment expectations. kmemdup provides a byte-granular copy without page-alignment guarantees, while iomap's inline-data contract requires the buffer to reside within one page. The patch replaces the kmemdup allocation with alloc_page, guaranteeing alignment and satisfying iomap_inline_data_valid.

Attack Vector

The vulnerability is triggered by write operations against NTFS files small enough to use the inline-data representation. Any local workload that mounts an NTFS volume with the ntfs3 driver and performs writes matching the inline-data code path can encounter the fault. Because triggering requires mounting an NTFS filesystem and performing writes, the practical exposure is local rather than remote. Exploitation results in a kernel panic rather than code execution.

See the upstream fixes at Kernel Git Commit 3cd2212 and Kernel Git Commit 70d3855 for technical details.

Detection Methods for CVE-2026-80868

Indicators of Compromise

Kernel log entries showing BUG messages originating in iomap_write_end_inline or iomap_inline_data_valid.
Unexpected kernel panics or oops traces referencing the ntfs3 module during file write activity.
System crashes correlated with mounting or writing to NTFS volumes handled by ntfs3.

Detection Strategies

Parse dmesg and journal logs for stack traces containing ntfs3 frames alongside iomap functions.
Monitor host uptime and unplanned reboots on systems that mount NTFS filesystems.
Inventory kernel versions across the fleet and flag hosts running builds that predate commits 3cd2212 and 70d3855.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on BUG: and Oops: entries tied to filesystem modules.
Track NTFS mount events on Linux hosts, including removable media and containers.
Correlate crash telemetry with recent NTFS write activity to distinguish this bug from unrelated kernel faults.

How to Mitigate CVE-2026-80868

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 3cd2212 and 70d3855 or upgrade to a stable kernel release that includes them.
Restrict who can mount NTFS volumes on multi-user systems by tightening mount permissions and udev automount policies.
Audit hosts and workloads that rely on the ntfs3 driver to prioritize patching order.

Patch Information

The fix replaces the kmemdup-based allocation of iomap inline_data with alloc_page, ensuring the buffer is page-aligned and satisfies iomap_inline_data_valid. Consume the fix by upgrading to a distribution kernel that backports the two upstream commits, or by rebuilding from a stable kernel tree that already contains them.

Workarounds

Avoid mounting untrusted NTFS media on hosts running unpatched kernels.
Where NTFS access is required but patching is delayed, use the older userspace ntfs-3g FUSE driver instead of the in-kernel ntfs3 driver.
Disable automatic mounting of removable NTFS devices on servers and shared workstations until the kernel is updated.

bash

# Confirm which NTFS driver is currently handling mounts
mount | grep -i ntfs
lsmod | grep ntfs3

# Temporarily prevent the vulnerable driver from loading
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf
sudo update-initramfs -u