CVE-2026-80598

A flaw was found in the ntfs3 component of the Linux kernel. This vulnerability occurs because the decompress_lznt() function, responsible for decompressing data, does not correctly check the boundaries of an array index. An attacker could exploit this by providing a corrupted NTFS3 image containing invalid compressed data. This could lead to an out-of-bounds read, potentially causing system instability or the disclosure of sensitive information.

A moderate out-of-bounds read vulnerability was found in the ntfs3 filesystem driver of the Linux kernel. The decompress_lznt() function does not validate array index bounds before accessing the decompression table, so a local attacker with the ability to mount a corrupted NTFS3 image containing invalid compressed data could trigger an out-of-bounds read, most likely resulting in a kernel panic and denial of service. Red Hat assessed this flaw as Moderate severity (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and the ability to mount a filesystem, and the practical impact is limited to availability; this is lower than the CVE.org score of 7.8, which assumes high confidentiality and integrity impacts that are not established for an out-of-bounds read in this code path. All currently assessed Red Hat products, including the kernel and kernel-rt components of Red Hat Enterprise Linux and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in the shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.