CVE-2026-80674

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because resident attribute lists are copied without proper validation. A local attacker could craft a malicious NTFS attribute list, leading to out-of-bounds reads of the attribute-list buffer. This could result in information disclosure or a denial of service.

A moderate-severity out-of-bounds read flaw exists in the Linux kernel's NTFS file system driver, and no Red Hat Enterprise Linux kernel or kernel-rt stream tracked for this CVE is affected, because the vulnerable code is not present in the shipped kernels. The flaw arises because ntfs_read_locked_inode() copies a resident $ATTRIBUTE_LIST into memory with a plain memcpy() and no validation, unlike the non-resident path, which is sanity-checked by load_attribute_list(). A crafted resident attribute list therefore reaches the later attribute-list walks (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()) unvalidated and can drive out-of-bounds reads of the attribute-list buffer. A local attacker with sufficient privilege to mount a specially crafted NTFS filesystem could use this flaw to read out-of-bounds kernel memory (information disclosure) or cause a kernel panic (denial of service). The CVE.org record scores this flaw as critical (9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); that severity differs significantly from Red Hat's moderate rating (5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and mount privileges rather than unauthenticated network access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.