CVE-2026-80674

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NTFS driver where resident attribute lists are not properly validated. The function ntfs read locked inode() copies a resident attribute list into ni->attr list using memcpy() without validation. Consequently, subsequent operations in ntfs external attr find(), ntfs inode attach all extents(), and ntfs attrlist need() trust that the entries are well-formed, which can lead to out-of-bounds reads of the attribute-list buffer when processing a crafted resident attribute list. Additionally, the load attribute list() function contains a validation loop that can over-read the fixed header of a truncated trailing entry by several bytes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.