Linux Kernel CVE-2026-80674

Exploitation requires the kernel to parse an attacker-controlled NTFS volume containing a crafted resident $ATTRIBUTE_LIST - concretely, a malicious NTFS filesystem image or device must be mounted or read by the vulnerable in-kernel NTFS driver. Limiting factors: the attacker needs a way to introduce and cause mounting of that media (physical/removable-media access, an automount configuration, or a workflow that reads untrusted disk images), the NTFS module must be built and loadable, and the primitive is an out-of-bounds read (information disclosure / crash) rather than direct code execution. Despite the supplied AV:N/PR:N vector, there is no described remote or unauthenticated network path; the realistic prerequisite is local access to the mount/read path.

The signals conflict sharply and should be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) implies remote unauthenticated network exploitation, but the vulnerability is triggered by parsing a crafted NTFS volume - an inherently local operation requiring the attacker to get a malicious filesystem mounted or read, so the network vector is almost certainly incorrect; verify with the kernel maintainers before treating this as remotely exploitable. The technical impact is an out-of-bounds READ, which most naturally yields kernel information disclosure and denial of service (crash), not the arbitrary code execution the 9.8/C:H/I:H/A:H would suggest - the high-integrity claim is not supported by the described primitive. Supporting the lower real-world urgency: EPSS is only 0.15% (5th percentile), the CVE is not on CISA KEV, and no public PoC is indicated. Net assessment: a legitimate memory-safety fix worth patching in normal cadence, but the raw 9.8 overstates real-world risk given the local attack surface, read-only primitive, and absence of exploitation evidence; environments that automount removable NTFS media (kiosks, forensic workstations, desktops) should weight it higher than servers that never touch NTFS.

An attacker crafts an NTFS filesystem image whose base inode carries a malformed resident $ATTRIBUTE_LIST, then gets a victim to mount or open it - for example via an inserted USB drive on a system that automounts NTFS, or a disk image processed by a forensic/analysis workflow. When the kernel reads the inode, the unvalidated attribute-list walk over-reads adjacent kernel memory, leaking data or crashing the machine. No public proof-of-concept is currently identified, and exploitation requires local access to the media/mount path rather than a network position.