Linux Kernel CVE-2026-80673

Exploitation requires the attacker to supply a crafted on-disk NTFS $ATTRIBUTE_LIST (a maliciously formatted volume/image) that is then mounted and read by the in-kernel NTFS driver, with the trigger being an attribute lookup carrying a non-zero lowest_vcn whose last attribute-list entry is positioned a few bytes before the end of the kvmalloc'd buffer. Limiting factors: the vulnerable path is local, not network-reachable; it needs the legacy in-kernel NTFS module loaded and the target volume mounted and its inode read (typically via physical/removable media or an auto-mount service); systems using only ntfs-3g/FUSE or that never mount untrusted NTFS media are not exposed.

The supplied CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is inconsistent with the described mechanism and should be treated as automated over-scoring - verify with vendor. This is a local filesystem-parsing OOB read triggered only when a maliciously crafted NTFS image is mounted and its inode read, not remote unauthenticated RCE. The realistic vector is local (AV:L) with some privilege/interaction needed to mount the volume, and impact is bounded to disclosure of adjacent slab memory and potential kernel crash (DoS), so I:H is not supportable. Corroborating signals align with lower urgency: EPSS is 0.15%, there is no KEV listing, and no POC is referenced. Net priority is low-to-moderate - patch on the normal kernel-update cadence rather than as an emergency, unless untrusted removable-media auto-mount is common in the environment.

An attacker crafts an NTFS image whose last $ATTRIBUTE_LIST entry sits a few bytes before the buffer's end and delivers it on a USB stick or as a mountable image; when the victim or an auto-mount service reads an inode on that volume, the kernel reads past the attribute-list buffer, leaking adjacent slab memory or panicking. No POC is referenced, and the local attack requires the crafted volume to actually be mounted and traversed.