CVE-2026-80674

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate resident attribute lists and harden the validator

A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list()

only on the non-resident path; ntfs_read_locked_inode() copies a *resident*

attribute list into ni->attr_list with a plain memcpy() and no validation

at all. Every subsequent walk of ni->attr_list --

ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and

ntfs_attrlist_need() -- then trusts the entries are well-formed and reads

attr_list_entry fixed-header fields

(lowest_vcn at offset 8, mft_reference at offset 16, and the name) with

bounds that assume validation already happened. A crafted resident

attribute list therefore reaches those walks unvalidated and can drive

out-of-bounds reads of the attribute-list buffer.

load_attribute_list() itself reads ale->name_offset (offset 7),

ale->mft_reference (offset 16) and the name length under only an

"al < al_start + size" bound, so its own validation loop can over-read the

fixed header of a truncated trailing entry by a few bytes.

Factor the per-entry validation into ntfs_attr_list_entry_is_valid(),

which requires each entry's fixed header (offsetof(struct

attr_list_entry, name)) to be in range before any field is dereferenced,

that ale->length is a multiple of 8 covering the fixed header plus the

name, and that the entry is in use and carries a live MFT reference.

ntfs_attr_list_is_valid() walks the buffer with it and checks the entries

tile it exactly. Use the list validator in load_attribute_list()

(replacing the open-coded loop, closing its own over-read) and on the

resident path in ntfs_read_locked_inode() (which previously skipped

validation entirely); patches 2/3 reuse the per-entry helper at the other

two attribute-list walks.