CVE-2026-80673

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the look-ahead attribute-list entry in ntfs external attr find()

When resolving an attribute lookup with a non-zero @lowest vcn, ntfs external attr find() peeks at the next $ATTRIBUTE LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next al entry + 6 < al end" (which proves just bytes 0..6 are in range) and "(u8 *)next al entry + length <= al end" with an attacker-controlled, non-8-aligned length. It then reads next al entry->lowest vcn (an le64 at offset 8) and the name at next al entry->name offset, both of which can lie past al end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr list size, no rounding). A crafted on-disk $ATTRIBUTE LIST whose last entry sits a few bytes before al end therefore yields a slab out-of-bounds read when the inode is read.

Validate the look-ahead entry with ntfs attr list entry is valid() (added in patch 1/3) before dereferencing lowest vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.