CVE-2026-80598: ntfs3: fix out-of-bounds read in decompress_lznt
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix out-of-bounds read in decompresslznt
decompresslznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.
Add index bounds checking to prevent the OOB access.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
The attacker needs to provide a corrupted NTFS3 image containing invalid compressed data. The malformed compressed data can cause decompress_lznt() to access the decompression table with an out-of-bounds index.
Which systems are exposed?
Systems using the Linux kernel and processing NTFS3 images are relevant to this issue. The provided information does not identify affected kernel versions or whether NTFS3 must be explicitly enabled or mounted.
What is the mitigation if the fix cannot be deployed immediately?
Avoid processing or mounting untrusted NTFS3 images, particularly images that may contain malformed compressed data. The vulnerability is addressed by adding bounds checking before the decompression-table access.