CVE-2026-80674: ntfs: validate resident attribute lists and harden the validator
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate resident attribute lists and harden the validator
A base inode's $ATTRIBUTELIST is sanity-checked by loadattributelist() only on the non-resident path; ntfsreadlockedinode() copies a resident attribute list into ni->attrlist with a plain memcpy() and no validation at all. Every subsequent walk of ni->attrlist -- ntfsexternalattrfind(), ntfsinodeattachallextents() and ntfsattrlistneed() -- then trusts the entries are well-formed and reads attrlistentry fixed-header fields (lowestvcn at offset 8, mftreference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer.
loadattributelist() itself reads ale->nameoffset (offset 7), ale->mftreference (offset 16) and the name length under only an "al < alstart + size" bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes.
Factor the per-entry validation into ntfsattrlistentryisvalid(), which requires each entry's fixed header (offsetof(struct attrlistentry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfsattrlistisvalid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in loadattributelist() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfsreadlockedinode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.
Event History
Frequently Asked Questions
What does an attacker need to control to trigger this issue?
The attacker needs a crafted NTFS attribute list that is resident in a base inode. The malformed list can include truncated entries or invalid entry fields that are subsequently trusted by attribute-list walks.
What kernel activity reaches the vulnerable parsing paths?
The issue is reached while reading a locked NTFS inode and later walking its attribute list. The affected walks include ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), and ntfs_attrlist_need().
What does the fix change?
The fix validates resident attribute lists before copying and using them, and hardens validation of individual entries. In particular, it prevents fixed-header and name-field reads when a trailing entry is too short or otherwise invalid.