CVE-2026-80672

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability arises from an integer truncation error when validating the size of the $LogFile restart area and its log client record array. An attacker can exploit this by mounting a specially crafted NTFS image, leading to an out-of-bounds read. This could result in information disclosure or a denial of service.

A moderate-severity flaw was found in the Linux kernel's classic NTFS filesystem driver. The length of the $LogFile restart area and its trailing log client record array is computed into a 16-bit variable, so when a specially crafted NTFS image declares a large number of log clients, the computed length wraps around and the check that verifies the structure fits within the system page size incorrectly passes. The kernel then walks the log client record array beyond the allocated buffer, resulting in an out-of-bounds read of kernel memory that can cause a system crash or potential information disclosure. Exploiting this flaw requires local access and the ability to mount an attacker-supplied NTFS filesystem image.

All Red Hat Enterprise Linux kernel and kernel-rt components and all Red Hat In-Vehicle OS kernel components are marked not affected because the vulnerable code is not present in the shipped Red Hat kernels. The upstream CVE record rates this flaw as important severity (CVSS 8.8), while Red Hat assesses it as moderate severity (CVSS 5.5); Red Hat's scoring reflects that this is a local out-of-bounds read with primarily availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.