CVE-2026-80869

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the attribute-list entry in ntfs read inode mount()

The $MFT attribute-list walk in ntfs read inode mount() validates each entry only with "(u8 *)al entry + 6 > al end" and "(u8 *)al entry + le16 to cpu(al entry->length) > al end", but then reads al entry->lowest vcn (an le64 at offset 8) and al entry->mft reference (offset 16) -- fields beyond the 6 bytes proven in range. al entry->length is attacker-controlled and only required non-zero, so a short entry (e.g. length 8) placed at the tail passes both checks while the lowest vcn / mft reference reads fall past al end.

al end is ni->attr list + attr list size (the on-disk size); the buffer is kvzalloc(round up(attr list size, SECTOR SIZE)), so the sector rounding usually absorbs the over-read -- but when attr list size is a multiple of SECTOR SIZE there is no slack and a crafted $MFT attribute list produces an out-of-bounds read at mount time.

Validate the entry with ntfs attr list entry is valid() (added in patch 1/3) before dereferencing it, matching the bound the other attribute-list walks now use. The validator already requires the length to cover the fixed header, which makes the separate "!al entry->length" check redundant, so drop it too.