CVE-2026-80673

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound the look-ahead attribute-list entry in ntfsexternalattr_find()

When resolving an attribute lookup with a non-zero @lowest_vcn,

ntfsexternalattrfind() peeks at the next $ATTRIBUTELIST entry to

decide whether to keep searching, but bounds that not-yet-validated

entry only with "(u8 *)nextalentry + 6 < al_end" (which proves just

bytes 0..6 are in range) and "(u8 *)nextalentry + length <= al_end"

with an attacker-controlled, non-8-aligned length. It then reads

nextalentry->lowestvcn (an _le64 at offset 8) and the name at

nextalentry->nameoffset, both of which can lie past alend -- the

exact end of the kvmalloc'd attribute-list buffer (allocated at the

on-disk attrlistsize, no rounding). A crafted on-disk $ATTRIBUTE_LIST

whose last entry sits a few bytes before al_end therefore yields a slab

out-of-bounds read when the inode is read.

Validate the look-ahead entry with ntfsattrlistentryis_valid() (added

in patch 1/3) before dereferencing lowest_vcn and the name, so the same

fixed-header, length and name bounds the main attribute-list walk uses now

guard this read too.