CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 ra_ofs, ra_len, ca_ofs; ... ra_len = ca_ofs + le16_to_cpu(ra->log_clients) * sizeof(struct log_client_record); if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...) return false; ra_len is u16, but the right-hand side is computed in size_t (sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients come straight from the on-disk restart area. With an on-disk log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64 gives ra_len 128), so the "fits in the page" check passes even though the client array described by log_clients extends far beyond the page. ntfs_check_log_client_array() then walks the array bounded only by the on-disk log_clients count: cr = ca + idx; if (cr->prev_client != LOGFILE_NO_CLIENT) ... For log_clients 410 it dereferences records up to ca + 409 * 160, ~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an out-of-bounds read of attacker-controlled extent, reachable when a crafted NTFS image is mounted (load_and_check_logfile() at mount time). This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g userspace driver but never in this revived classic driver. Compute the restart-area length in a u32 so the existing bounds check rejects an over-large client array instead of being defeated by the truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded from __le16 on-disk fields and every comparison already promotes to int/size_t, so this changes no result and keeps the declaration uniform.

• https://git.kernel.org/stable/c/07a4751ef3ccc8bfd17bfbb16e5003c03161790d
• https://git.kernel.org/stable/c/390936fb15053d8d8991ca3a22776e251a5a7f2f

Published

Aug 28, 2026

Last Modified

Aug 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80666In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80667In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80668In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-80669In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80670In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-80671In the Linux kernel, the following vulnerability has been re…9.3
• CVE-2026-80673In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-80674In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-80675In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-80676In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80677In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-80678In the Linux kernel, the following vulnerability has been re…8.4