{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80672","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.782Z","datePublished":"2026-08-28T06:49:12.340Z","dateUpdated":"2026-08-29T06:21:59.169Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-29T06:21:59.169Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix u16 truncation of restart-area length check\n\nntfs_check_restart_area() validates that the $LogFile restart area and\nits trailing log client record array fit within the system page size:\n\n        u16 ra_ofs, ra_len, ca_ofs;\n        ...\n        ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *\n                        sizeof(struct log_client_record);\n        if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...)\n                return false;\n\nra_len is u16, but the right-hand side is computed in size_t\n(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients\ncome straight from the on-disk restart area. With an on-disk\nlog_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and\nstoring into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64\ngives ra_len 128), so the \"fits in the page\" check passes even though\nthe client array described by log_clients extends far beyond the page.\n\nntfs_check_log_client_array() then walks the array bounded only by the\non-disk log_clients count:\n\n        cr = ca + idx;\n        if (cr->prev_client != LOGFILE_NO_CLIENT) ...\n\nFor log_clients 410 it dereferences records up to ca + 409 * 160,\n~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an\nout-of-bounds read of attacker-controlled extent, reachable when a\ncrafted NTFS image is mounted (load_and_check_logfile() at mount time).\nThis is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g\nuserspace driver but never in this revived classic driver.\n\nCompute the restart-area length in a u32 so the existing bounds check\nrejects an over-large client array instead of being defeated by the\ntruncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded\nfrom __le16 on-disk fields and every comparison already promotes to\nint/size_t, so this changes no result and keeps the declaration uniform."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only when the in-kernel NTFS driver parses $LogFile metadata during a local block-device or loopback mount (ntfs_fill_super → load_and_check_logfile); it is not triggered by network packet handling, ksmbd, nfsd, or remote file I/O on an already-mounted volume.\nAC:L - An attacker fully controls on-disk restart-area fields (log_clients, client_array_offset, client lists); values such as log_clients=410 reliably defeat the u16 length truncation and force ntfs_check_log_client_array() to walk far beyond the allocated restart-page buffer.\nPR:L - Exploitation requires mounting a crafted NTFS image, which unprivileged users can do via user namespaces (CAP_SYS_ADMIN in a new userns) and loop/fsopen/fsmount without init-namespace root; it is not a pre-auth network service path.\nUI:N - No victim interaction is required when the attacker mounts their own crafted image (e.g., loop device in a user namespace); the malicious $LogFile metadata is consumed automatically at mount time before any separate file access.\nS:C - A guest, container tenant, or external party can embed the malicious $LogFile in a disk image that crosses into the host/examiner security domain when an administrator or automated tooling mounts that NTFS volume on the host kernel, escaping the source disk's trust boundary.\nC:H - ntfs_check_log_client_array() performs an out-of-bounds read of roughly 64 KiB past a system_page_size kvzalloc buffer, disclosing adjacent kernel heap/slab memory rather than being limited to a few bytes of bounded leakage.\nI:H - Large kernel heap out-of-bounds reads of attacker-influenced extent and adjacent objects are memory-corruption primitives that can be groomed into arbitrary write or code-execution chains, matching the impact class of the analogous CVE-2022-30789 log-client-array bug.\nA:H - Dereferencing client records ~64 KiB beyond a single-page allocation is very likely to touch unmapped pages or corrupt adjacent kernel structures, producing kernel oops/panic or hang during mount-time logfile validation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/logfile.c"],"versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","lessThan":"07a4751ef3ccc8bfd17bfbb16e5003c03161790d","status":"affected","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","lessThan":"390936fb15053d8d8991ca3a22776e251a5a7f2f","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/logfile.c"],"versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/07a4751ef3ccc8bfd17bfbb16e5003c03161790d"},{"url":"https://git.kernel.org/stable/c/390936fb15053d8d8991ca3a22776e251a5a7f2f"}],"title":"ntfs: fix u16 truncation of restart-area length check","x_generator":{"engine":"bippy-1.2.0"}}}}