CVE-2026-80674

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate resident attribute lists and harden the validator

A base inode's $ATTRIBUTELIST is sanity-checked by loadattribute_list()

only on the non-resident path; ntfsreadlocked_inode() copies a resident

attribute list into ni->attr_list with a plain memcpy() and no validation

at all. Every subsequent walk of ni->attr_list --

ntfsexternalattrfind(), ntfsinodeattachall_extents() and

ntfsattrlistneed() -- then trusts the entries are well-formed and reads

attrlistentry fixed-header fields

(lowestvcn at offset 8, mftreference at offset 16, and the name) with

bounds that assume validation already happened. A crafted resident

attribute list therefore reaches those walks unvalidated and can drive

out-of-bounds reads of the attribute-list buffer.

loadattributelist() itself reads ale->name_offset (offset 7),

ale->mft_reference (offset 16) and the name length under only an

"al < al_start + size" bound, so its own validation loop can over-read the

fixed header of a truncated trailing entry by a few bytes.

Factor the per-entry validation into ntfsattrlistentryis_valid(),

which requires each entry's fixed header (offsetof(struct

attrlistentry, name)) to be in range before any field is dereferenced,

that ale->length is a multiple of 8 covering the fixed header plus the

name, and that the entry is in use and carries a live MFT reference.

ntfsattrlistisvalid() walks the buffer with it and checks the entries

tile it exactly. Use the list validator in loadattributelist()

(replacing the open-coded loop, closing its own over-read) and on the

resident path in ntfsreadlocked_inode() (which previously skipped

validation entirely); patches 2/3 reuse the per-entry helper at the other

two attribute-list walks.