CVE-2026-80869: ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound the attribute-list entry in ntfsreadinodemount()
The $MFT attribute-list walk in ntfsreadinodemount() validates each entry only with "(u8 )alentry + 6 > alend" and "(u8 )alentry + le16tocpu(alentry->length) > alend", but then reads alentry->lowestvcn (an le64 at offset 8) and alentry->mftreference (offset 16) -- fields beyond the 6 bytes proven in range. alentry->length is attacker-controlled and only required non-zero, so a short entry (e.g. length 8) placed at the tail passes both checks while the lowestvcn / mftreference reads fall past alend.
alend is ni->attrlist + attrlistsize (the on-disk size); the buffer is kvzalloc(roundup(attrlistsize, SECTORSIZE)), so the sector rounding usually absorbs the over-read -- but when attrlistsize is a multiple of SECTORSIZE there is no slack and a crafted $MFT attribute list produces an out-of-bounds read at mount time.
Validate the entry with ntfsattrlistentryisvalid() (added in patch 1/3) before dereferencing it, matching the bound the other attribute-list walks now use. The validator already requires the length to cover the fixed header, which makes the separate "!alentry->length" check redundant, so drop it too.
Affected Software
Event History
Frequently Asked Questions
When can the out-of-bounds read be triggered?
It is triggered while mounting an NTFS filesystem whose $MFT attribute list contains a crafted short attribute-list entry. The condition requires the on-disk attribute-list size to be an exact multiple of the sector size, leaving no allocation-rounding slack for the invalid read.
What access does an attacker need?
An attacker needs control over NTFS filesystem metadata, specifically the $MFT attribute list presented during mount. The vulnerable parsing occurs at mount time.