CVE-2026-80672

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix u16 truncation of restart-area length check

ntfs_check_restart_area() validates that the $LogFile restart area and

its trailing log client record array fit within the system page size:

u16 ra_ofs, ra_len, ca_ofs;

...

ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *

sizeof(struct log_client_record);

if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...)

return false;

ra_len is u16, but the right-hand side is computed in size_t

(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients

come straight from the on-disk restart area. With an on-disk

log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and

storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64

gives ra_len 128), so the "fits in the page" check passes even though

the client array described by log_clients extends far beyond the page.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References