CVE-2026-80869: Linux Kernel NTFS Buffer Overflow Vulnerability

CVE-2026-80869 Overview

CVE-2026-80869 is an out-of-bounds read vulnerability in the Linux kernel's NTFS filesystem driver. The flaw resides in ntfs_read_inode_mount(), which walks the $MFT attribute list during filesystem mount. The function validates each attribute-list entry only against the first 6 bytes, then dereferences fields at offsets 8 and 16 without additional bounds checking. A crafted NTFS image with a short attribute-list entry positioned at the tail of the buffer triggers a read past al_end. The Linux kernel maintainers resolved the issue by introducing ntfs_attr_list_entry_is_valid() to fully bound each entry before dereferencing.

Critical Impact
A malicious NTFS filesystem image mounted on a vulnerable Linux system can trigger an out-of-bounds kernel read, potentially leading to information disclosure or a denial-of-service condition at mount time.

Affected Products

Linux kernel with the NTFS (read-only) filesystem driver enabled
Distributions shipping kernels prior to the fixing commits 98634df5b1cb and c7a7e48e71ce
Systems that allow mounting untrusted NTFS images (removable media, virtual disk images)

Discovery Timeline

2026-09-04 - CVE-2026-80869 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80869

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the NTFS attribute-list traversal logic of the Linux kernel. During mount, ntfs_read_inode_mount() iterates through each ATTR_LIST_ENTRY structure in the $MFT attribute list. The loop validates that (u8 *)al_entry + 6 > al_end and that (u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end are not violated. Both checks only confirm the first 6 bytes of the entry fall inside the buffer.

After the checks, the code reads al_entry->lowest_vcn, an __le64 at offset 8, and al_entry->mft_reference at offset 16. Because al_entry->length is attacker-controlled and only required to be non-zero, an entry with length = 8 placed at the tail of the buffer satisfies both validators while its 8-byte and 16-byte field reads land past al_end.

Root Cause

The attribute-list buffer is allocated via kvzalloc(round_up(attr_list_size, SECTOR_SIZE)). In typical cases, sector rounding provides trailing slack that absorbs the over-read. When attr_list_size is an exact multiple of SECTOR_SIZE, no slack exists and the dereference reads adjacent kernel memory. The root cause is insufficient boundary validation: the walker verified only the minimum entry header size rather than the full extent of the fields it later dereferences.

Attack Vector

Exploitation requires the ability to induce the kernel to mount an attacker-controlled NTFS filesystem image. Attack scenarios include inserting malicious removable media, supplying a crafted disk image to an automounter, or providing a loopback-mounted image in a multi-tenant environment. The attacker crafts a $MFT attribute list whose final entry has length = 8 and whose attr_list_size is a multiple of SECTOR_SIZE. On mount, the kernel reads 8 or more bytes past the allocation, potentially leaking kernel memory contents into subsequent processing or triggering a fault.

No verified proof-of-concept code is publicly available. Refer to the upstream commits 98634df5b1cb and c7a7e48e71ce for the fix implementation.

Detection Methods for CVE-2026-80869

Indicators of Compromise

Kernel oops or KASAN slab-out-of-bounds reports referencing ntfs_read_inode_mount in dmesg or journalctl -k output.
Unexpected mount failures or kernel panics coinciding with mounting of NTFS media from untrusted sources.
Mount attempts of NTFS images whose $MFT attribute list size is exactly a multiple of 512 bytes.

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch out-of-bounds reads in fs/ntfs/inode.c during fuzzing or triage.
Audit auditd or eBPF telemetry for mount() syscalls targeting NTFS on systems that should not process untrusted filesystems.
Correlate USB insertion events with subsequent kernel warnings referencing the NTFS driver.

Monitoring Recommendations

Forward kernel logs to a central SIEM and alert on NTFS driver stack traces originating from ntfs_read_inode_mount.
Track kernel version inventory across the fleet to identify hosts still running unpatched NTFS-capable kernels.
Monitor removable media policy violations, particularly automatic mounting of external NTFS volumes on servers.

How to Mitigate CVE-2026-80869

Immediate Actions Required

Apply the upstream kernel patches 98634df5b1cb and c7a7e48e71ce or upgrade to a distribution kernel that includes them.
Disable automatic mounting of removable NTFS media on servers and multi-user systems until patches are deployed.
Restrict which users can invoke mount for filesystem types they do not require.

Patch Information

The fix introduces a helper, ntfs_attr_list_entry_is_valid(), that validates the full attribute-list entry, including the fields at offsets 8 and 16, before any dereference. The redundant !al_entry->length check is removed because the new validator already enforces that the length covers the fixed header. Both commits 98634df5b1cb56c26299b7409227025ddb0167d8 and c7a7e48e71ce915ec4cbd6e9f355590c1ecbc29a are available in the upstream stable tree.

Workarounds

Blacklist the ntfs kernel module on hosts that do not require read-only NTFS support using echo 'blacklist ntfs' > /etc/modprobe.d/ntfs.conf.
Prefer FUSE-based ntfs-3g for user-space NTFS access, which does not exercise the vulnerable in-kernel code path.
Enforce policy that untrusted disk images are mounted only inside isolated virtual machines rather than on the host kernel.

bash

# Configuration example: prevent the vulnerable in-kernel NTFS driver from loading
echo 'blacklist ntfs' | sudo tee /etc/modprobe.d/disable-ntfs.conf
sudo update-initramfs -u
sudo reboot