DEBIAN-CVE-2026-80673

In the Linux kernel, the following vulnerability has been resolved:  ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind()  When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind() peeks at the next $ATTRIBUTELIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)nextalentry + 6 < alend" (which proves just bytes 0..6 are in range) and "(u8 *)nextalentry + length <= alend" with an attacker-controlled, non-8-aligned length. It then reads nextalentry->lowestvcn (an le64 at offset 8) and the name at nextalentry->nameoffset, both of which can lie past alend -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attrlistsize, no rounding). A crafted on-disk $ATTRIBUTELIST whose last entry sits a few bytes before alend therefore yields a slab out-of-bounds read when the inode is read.  Validate the look-ahead entry with ntfsattrlistentryisvalid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.