HIGH Introduced in 5.15
ntfs3 Lznt OOB
CVE-2026-80598
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read. Add index bounds checking to prevent the OOB access.
02KernelScan AI Analysis
Risk summary
A corrupted NTFS3 filesystem image with invalid compressed data can trigger an out-of-bounds read in the LZNT decompression routine. This can lead to denial of service (kernel crash) or potential information disclosure. The vulnerability is triggered when mounting or reading from a malicious NTFS3 filesystem image.
Vulnerability analysis
The LZNT decompression routine in the ntfs3 filesystem driver fails to validate index bounds before accessing an internal lookup table. When processing compressed data from a corrupted NTFS3 image, the index can increment beyond the table's bounds, causing an out-of-bounds read. The fix adds a bounds check to keep the index within the table's limits. This vulnerability is reachable by any user who can cause a malicious NTFS3 filesystem image to be mounted and read, which typically requires either physical access to removable media or root privileges to mount an attacker-supplied image.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15 | 5.15.212 | 1113fa5b01a4 |
| 6.1 | 5.15 | 6.1.178 | 61415ffa365d |
| 6.12 | 5.15 | 6.12.97 | c694f8ea2611 |
| 6.18 | 5.15 | 6.18.40 | ff05a98150eb |
| 6.6 | 5.15 | 6.6.145 | bd77afca2ae9 |
| 7.1 | 5.15 | 7.1.5 | a93980141253 |
| mainline | 5.15 | 7.2 | 7160a57192fb |
| cip/6.1 | 5.15 | 6.1.182-cip59 | 61415ffa365d |
| cip/6.1-rt | 5.15 | 6.1.182-cip59-rt31 | 61415ffa365d |
| cip/6.12 | 5.15 | 6.12.101-cip29 | c694f8ea2611 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.182-cip59 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |