{"apiVersion":"1.0","identifier":"CVE-2026-80674","description":"In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode-s $ATTRIBUTE_LIST is sanity-checked by load_attribute_list() only on the non-resident path; ntfs_read_locked_inode() copies a *resident* attribute list into ni->attr_list with a plain memcpy() and no validation at all. Every subsequent walk of ni->attr_list -- ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and ntfs_attrlist_need() -- then trusts the entries are well-formed and reads attr_list_entry fixed-header fields (lowest_vcn at offset 8, mft_reference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer. load_attribute_list() itself reads ale->name_offset (offset 7), ale->mft_reference (offset 16) and the name length under only an -al < al_start + size- bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes. Factor the per-entry validation into ntfs_attr_list_entry_is_valid(), which requires each entry-s fixed header (offsetof(struct attr_list_entry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfs_attr_list_is_valid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in load_attribute_list() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfs_read_locked_inode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.","publishedAt":"2026-08-28T08:16:52","lastModifiedAt":"2026-08-28T08:16:52","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80674","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00155,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-80674","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-80674","en":"https://www.redsauce.net/en/cves/CVE-2026-80674","fr":"https://www.redsauce.net/fr/cves/CVE-2026-80674","pt":"https://www.redsauce.net/pt/cves/CVE-2026-80674","de":"https://www.redsauce.net/de/cves/CVE-2026-80674","sk":"https://www.redsauce.net/sk/cves/CVE-2026-80674","el":"https://www.redsauce.net/el/cves/CVE-2026-80674"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-80674"}}