Look up another CVE · open CVE-2026-80672 in the interactive tracker
CVE-2026-80672
ntfs: fix u16 truncation of restart-area length check
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem fs/ntfs. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80672 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 ra_ofs, ra_len, ca_ofs; ... ra_len = ca_ofs + le16_to_cpu(ra->log_clients) * sizeof(struct log_client_record); if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...) return false; ra_len is u16, but the right-hand side is computed in size_t (sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients come straight from the on-disk restart area. With an on-disk log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64 gives ra_len 128), so the "fits in the page" check passes even though the client array described by log_clients extends far beyond the page. ntfs_check_log_client_array() then walks the array bounded only by the on-disk log_clients count: cr = ca + idx; if (cr->prev_client != LOGFILE_NO_CLIENT) ... For log_clients 410 it dereferences records up to ca + 409 * 160, ~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an out-of-bounds read of attacker-controlled extent, reachable when a crafted NTFS image is mounted (load_and_check_logfile() at mount time). This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g userspace driver but never in this revived classic driver. Compute the restart-area length in a u32 so the existing bounds check rejects an over-large client array instead of being defeated by the truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded from __le16 on-disk fields and every comparison already promotes to int/size_t, so this changes no result and keeps the declaration uniform.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ntfs/logfile.c
- What this is
- NTFS FILESYSTEMMAINTAINERS section matched on fs/ntfs/ · linux-fsdevel@vger.kernel.org · Maintained
- Kernel module
- ntfs
Check it on the machine
grep -wE 'CONFIG_NTFS_FS|CONFIG_NTFS_RW' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ntfsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 1 release. It does build it in 2 releases, so the answer depends on which release the machine runs. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookwormn
- trixie?
- forky, sidm
- n
- not enabled on any flavour - this release does not build the code
- ?
- not established - no Makefile entry for the affected file
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_NTFS_FS, CONFIG_NTFS_RW
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/ntfs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.1 | 7.1.5 | 07a4751ef3cc |
| 7.1 | 7.2 | 390936fb1505 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is reached only when the in-kernel NTFS driver parses $LogFile metadata during a local block-device or loopback mount (ntfs_fill_super → load_and_check_logfile); it is not triggered by network packet handling, ksmbd, nfsd, or remote file I/O on an already-mounted volume.
- AC:LAttack complexity, low
- An attacker fully controls on-disk restart-area fields (log_clients, client_array_offset, client lists); values such as log_clients=410 reliably defeat the u16 length truncation and force ntfs_check_log_client_array() to walk far beyond the allocated restart-page buffer.
- PR:LPrivileges required, low
- Exploitation requires mounting a crafted NTFS image, which unprivileged users can do via user namespaces (CAP_SYS_ADMIN in a new userns) and loop/fsopen/fsmount without init-namespace root; it is not a pre-auth network service path.
- UI:NUser interaction, none
- No victim interaction is required when the attacker mounts their own crafted image (e.g., loop device in a user namespace); the malicious $LogFile metadata is consumed automatically at mount time before any separate file access.
- S:CScope, changed
- A guest, container tenant, or external party can embed the malicious $LogFile in a disk image that crosses into the host/examiner security domain when an administrator or automated tooling mounts that NTFS volume on the host kernel, escaping the source disk's trust boundary.
- C:HConfidentiality impact, high
- ntfs_check_log_client_array() performs an out-of-bounds read of roughly 64 KiB past a system_page_size kvzalloc buffer, disclosing adjacent kernel heap/slab memory rather than being limited to a few bytes of bounded leakage.
- I:HIntegrity impact, high
- Large kernel heap out-of-bounds reads of attacker-influenced extent and adjacent objects are memory-corruption primitives that can be groomed into arbitrary write or code-execution chains, matching the impact class of the analogous CVE-2022-30789 log-client-array bug.
- A:HAvailability impact, high
- Dereferencing client records ~64 KiB beyond a single-page allocation is very likely to touch unmapped pages or corrupt adjacent kernel structures, producing kernel oops/panic or hang during mount-time logfile validation.