{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/logfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07a4751ef3ccc8bfd17bfbb16e5003c03161790d",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            },
            {
              "lessThan": "390936fb15053d8d8991ca3a22776e251a5a7f2f",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/logfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix u16 truncation of restart-area length check\n\nntfs_check_restart_area() validates that the $LogFile restart area and\nits trailing log client record array fit within the system page size:\n\n        u16 ra_ofs, ra_len, ca_ofs;\n        ...\n        ra_len = ca_ofs + le16_to_cpu(ra-\u003elog_clients) *\n                        sizeof(struct log_client_record);\n        if (ra_ofs + ra_len \u003e le32_to_cpu(rp-\u003esystem_page_size) || ...)\n                return false;\n\nra_len is u16, but the right-hand side is computed in size_t\n(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients\ncome straight from the on-disk restart area. With an on-disk\nlog_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and\nstoring into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64\ngives ra_len 128), so the \"fits in the page\" check passes even though\nthe client array described by log_clients extends far beyond the page.\n\nntfs_check_log_client_array() then walks the array bounded only by the\non-disk log_clients count:\n\n        cr = ca + idx;\n        if (cr-\u003eprev_client != LOGFILE_NO_CLIENT) ...\n\nFor log_clients 410 it dereferences records up to ca + 409 * 160,\n~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an\nout-of-bounds read of attacker-controlled extent, reachable when a\ncrafted NTFS image is mounted (load_and_check_logfile() at mount time).\nThis is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g\nuserspace driver but never in this revived classic driver.\n\nCompute the restart-area length in a u32 so the existing bounds check\nrejects an over-large client array instead of being defeated by the\ntruncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded\nfrom __le16 on-disk fields and every comparison already promotes to\nint/size_t, so this changes no result and keeps the declaration uniform."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only when the in-kernel NTFS driver parses $LogFile metadata during a local block-device or loopback mount (ntfs_fill_super \u2192 load_and_check_logfile); it is not triggered by network packet handling, ksmbd, nfsd, or remote file I/O on an already-mounted volume.\nAC:L - An attacker fully controls on-disk restart-area fields (log_clients, client_array_offset, client lists); values such as log_clients=410 reliably defeat the u16 length truncation and force ntfs_check_log_client_array() to walk far beyond the allocated restart-page buffer.\nPR:L - Exploitation requires mounting a crafted NTFS image, which unprivileged users can do via user namespaces (CAP_SYS_ADMIN in a new userns) and loop/fsopen/fsmount without init-namespace root; it is not a pre-auth network service path.\nUI:N - No victim interaction is required when the attacker mounts their own crafted image (e.g., loop device in a user namespace); the malicious $LogFile metadata is consumed automatically at mount time before any separate file access.\nS:C - A guest, container tenant, or external party can embed the malicious $LogFile in a disk image that crosses into the host/examiner security domain when an administrator or automated tooling mounts that NTFS volume on the host kernel, escaping the source disk\u0027s trust boundary.\nC:H - ntfs_check_log_client_array() performs an out-of-bounds read of roughly 64 KiB past a system_page_size kvzalloc buffer, disclosing adjacent kernel heap/slab memory rather than being limited to a few bytes of bounded leakage.\nI:H - Large kernel heap out-of-bounds reads of attacker-influenced extent and adjacent objects are memory-corruption primitives that can be groomed into arbitrary write or code-execution chains, matching the impact class of the analogous CVE-2022-30789 log-client-array bug.\nA:H - Dereferencing client records ~64 KiB beyond a single-page allocation is very likely to touch unmapped pages or corrupt adjacent kernel structures, producing kernel oops/panic or hang during mount-time logfile validation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:59.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07a4751ef3ccc8bfd17bfbb16e5003c03161790d"
        },
        {
          "url": "https://git.kernel.org/stable/c/390936fb15053d8d8991ca3a22776e251a5a7f2f"
        }
      ],
      "title": "ntfs: fix u16 truncation of restart-area length check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80672",
    "datePublished": "2026-08-28T06:49:12.340Z",
    "dateReserved": "2026-08-26T14:34:25.782Z",
    "dateUpdated": "2026-08-29T06:21:59.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}