CRITICAL Introduced in 7.1
ntfs AttributeList OOB
CVE-2026-80673
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read. Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.
02KernelScan AI Analysis
Risk summary
A crafted NTFS filesystem image with a malformed $ATTRIBUTE_LIST can cause an out-of-bounds read in kernel slab memory when an inode is read. An attacker who can cause a malicious filesystem image to be mounted can exploit this to leak kernel memory or trigger a kernel panic. The bug is triggered during attribute lookup and requires privileges to mount the filesystem, or physical access to a system that auto-mounts removable media.
Vulnerability analysis
When the NTFS driver looks up an attribute with a non-zero lowest VCN, it peeks at the next attribute-list entry to decide whether to continue searching. The bounds check on this look-ahead entry only validates the first few bytes and trusts an attacker-controlled length value, allowing reads of later fields and the attribute name to go past the end of the allocated attribute-list buffer. A crafted on-disk attribute list whose final entry sits just before the buffer boundary triggers a slab out-of-bounds read when the inode is parsed. The fix adds proper validation of the look-ahead entry before reading any of its fields, ensuring the entry is fully within the buffer bounds. This vulnerability is reachable by mounting a crafted NTFS filesystem image, which requires either physical access to insert removable media or privileges to mount a filesystem.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 7.1 | 7.1.5 | 44885c9b45eb |
| mainline | 7.1 | 7.2 | 344b18f389f9 |