CVE-2026-80598

CVE-2026-80598 is an out-of-bounds read in decompress_lznt() in the Linux kernel's ntfs3 (NTFS) filesystem driver, which indexes into a decompression table without validating that the index is within bounds. It is triggered locally when a corrupted or specially crafted NTFS image containing invalid compressed data is mounted (for example via removable media or an automount service), with no user interaction required beyond the mount. A local low-privilege attacker could read adjacent kernel memory (potential information disclosure) or crash the kernel; the assigned CVSS vector scores high confidentiality, integrity and availability impact, though no public proof-of-concept demonstrates the practical impact. Any Linux system running a kernel that includes the ntfs3 driver and that mounts untrusted NTFS volumes is affected; ntfs3 is not the default filesystem and many systems never load it. Exploitation status is quiet: no public PoC, not in CISA KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days (3rd percentile).

What to do: Apply a kernel update that includes the ntfs3 decompress_lznt bounds-check fix (the advisory does not name specific fixed version numbers). Until patching, avoid mounting untrusted NTFS volumes, disable or restrict automounting of removable media, and check whether your kernels build the ntfs3 driver (CONFIG_NTFS3_FS) to gauge actual exposure.