CVE-2026-80673

A flaw was found in the Linux kernel's NTFS file system driver. An attacker can craft a malicious on-disk attribute list that, when processed, causes an out-of-bounds read. This occurs because a look-ahead entry in the attribute list is not properly validated, allowing data to be read beyond the allocated buffer. This vulnerability can lead to information disclosure when an inode is read.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel NTFS file system driver. When resolving an attribute lookup, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry without fully validating it, so fields such as the entry's lowest_vcn and name can lie past the end of the allocated attribute-list buffer. An attacker who is able to mount a specially crafted NTFS filesystem can trigger this out-of-bounds read when the affected inode is read, which may disclose kernel memory contents or crash the system, resulting in a denial of service. Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS kernels are not affected by this flaw because the vulnerable code is not present in the Red Hat kernels. Red Hat rates this flaw moderate (5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs from the upstream CVEORG critical rating (9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploiting this flaw requires local access and the ability to mount a crafted filesystem rather than a network-based attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.