Linux Kernel CVE-2026-80672

Exploitation requires that the target kernel have the classic NTFS module (ntfs, not ntfs3) loaded or loadable, and that the attacker be able to trigger a mount of a crafted NTFS image. On typical desktop Linux systems with udisks2 or systemd automount configured, low-privileged users can mount removable NTFS media without additional privileges, making exploitation straightforward if the attacker controls physical media or a shared storage path. On server systems with strict mount policies, capability restrictions (CAP_SYS_ADMIN), or module deny-listing, the attack surface is substantially reduced. Systems exclusively using the ntfs3 driver, or where the ntfs module is absent or blocked via modprobe configuration, are not exposed. The vulnerability is triggered during load_and_check_logfile() at mount time - no post-mount interaction is required.

The CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a credible kernel-level impact potential, but several signals materially discount the urgency. The attack vector is strictly local: exploitation requires the ability to mount a crafted NTFS image, which on hardened systems demands explicit capability grants (CAP_SYS_ADMIN) or configured automount - a meaningful constraint absent from the CVSS score alone. The EPSS score of 0.15% at the 5th percentile represents an extremely low exploitation probability and substantially undercuts the high CVSS number; there is no CISA KEV listing and no known public exploit code, so the high CVSS reflects theoretical worst-case impact rather than observed threat actor activity. One signal mismatch warrants explicit note: the CVSS scope change (S:C) implies a kernel-to-system boundary crossing, which for a read-only OOB primitive is plausible as an information-leak stepping stone (e.g., KASLR bypass) but is not independently confirmed - organizations should treat I:H as aspirational without a chained write primitive. Overall, this flaw merits scheduled patch application on affected kernel versions but does not warrant emergency out-of-band response absent evidence of exploitation.

An attacker with local access places or inserts a crafted NTFS image - for example, a USB drive or a loop device file - containing a $LogFile restart area with log_clients set to 410 and a suitable ca_ofs value. When the kernel mounts the image via the classic NTFS driver at mount time, ntfs_check_restart_area() performs a truncated u16 bounds check that incorrectly passes, and ntfs_check_log_client_array() subsequently reads approximately 64 KiB of kernel heap memory beyond the allocated restart-page buffer, potentially disclosing sensitive kernel data. No public proof-of-concept exists at time of analysis, though the detailed technical description in the commit message provides sufficient grounding for exploit development.