CVE-2026-80674

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate resident attribute lists and harden the validator

A base inode's $ATTRIBUTELIST is sanity-checked by loadattributelist() only on the non-resident path; ntfsreadlockedinode() copies a resident attribute list into ni->attrlist with a plain memcpy() and no validation at all. Every subsequent walk of ni->attrlist -- ntfsexternalattrfind(), ntfsinodeattachallextents() and ntfsattrlistneed() -- then trusts the entries are well-formed and reads attrlistentry fixed-header fields (lowestvcn at offset 8, mft_reference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer.

loadattributelist() itself reads ale->nameoffset (offset 7), ale->mftreference (offset 16) and the name length under only an "al < al_start + size" bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes.

Factor the per-entry validation into ntfsattrlistentryisvalid(), which requires each entry's fixed header (offsetof(struct attrlistentry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfsattrlistisvalid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in loadattributelist() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfsreadlockedinode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.