CVE-2026-80673

CVE-2026-80673 is a slab out-of-bounds read in the legacy NTFS driver of the Linux kernel, in the ntfs_external_attr_find() function. When resolving an attribute lookup with a non-zero lowest_vcn, the code peeks at the next $ATTRIBUTE_LIST entry but bounds-checks it too loosely, so header, length, lowest_vcn, or name-offset fields of that unvalidated entry can lie past the end of the allocated attribute-list buffer. An attacker who can supply a crafted NTFS filesystem image (e.g., a mounted removable drive or disk image) whose final attribute-list entry sits just before the buffer end triggers the out-of-bounds read when the affected inode is read, potentially exposing kernel memory; the CVSS scoring rates the impact critical (9.8, high confidentiality/integrity/availability). Any Linux system running a kernel with the legacy fs/ntfs driver that mounts untrusted NTFS volumes is affected, though the advisory does not specify affected or fixed kernel version ranges. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days.

What to do: Update to a Linux kernel that includes the CVE-2026-80673 fix, which validates the look-ahead $ATTRIBUTE_LIST entry via ntfs_attr_list_entry_is_valid() before dereferencing it; the advisory does not name a fixed release, so track your distribution's kernel security updates for the backported patch. Until patched, avoid mounting NTFS volumes of untrusted origin and disable or blacklist the legacy ntfs module (CONFIG_NTFS_FS) if it is not needed. Administrators should check whether their running kernel builds fs/ntfs and whether removable or auto-mounted NTFS media is in use.