External risk intelligence

Linux Kernel NTFS Slab Out-of-Bounds Read Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80673

This vulnerability exists within the Linux kernel NTFS filesystem driver. Exploitation requires a user or system to mount a specially crafted, malicious filesystem or disk image. It is not a network-facing service or interface, and typical deployment involves local storage or restricted filesystem access rather than exposure to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's NTFS file system driver allows for out-of-bounds reads when processing attribute lists on a specially crafted disk image. This could lead to potential data corruption or system instability if an attacker can control the mounting of such an image. The main concern is confirming relevance and exposure due to the specific conditions required for exploitation.

Flaw in Linux NTFS driver allows reading beyond data limits.
Affects systems mounting untrusted NTFS file systems.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting a malicious NTFS filesystem on a disk. When the Linux kernel attempts to read an attribute from this filesystem, a specific function might process a malformed attribute entry. This could lead to an out-of-bounds read, potentially exposing sensitive data or causing system instability.

Malicious NTFS filesystem required.
Vulnerable code triggered during attribute lookup.
Out-of-bounds read leads to data disclosure.

Live Threat

Current exploitation, exposure, and threat context

When a specially crafted NTFS file system is read by the Linux kernel, it may lead to an out-of-bounds read within the kernel's memory. This vulnerability is present when the NTFS driver attempts to validate attributes within the file system structure.

Kernel memory could be read.
Reading a crafted NTFS file.
Information disclosure or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's NTFS driver requires an attacker to control a specially crafted filesystem or disk image. The first practical step is for infrastructure or platform teams to identify systems mounting potentially untrusted NTFS volumes and assess their business criticality before planning remediation.

Ownership: Infrastructure or platform teams.
Verify first: Systems mounting untrusted NTFS volumes.
Action: Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NTFS driver in the Linux kernel?

The NTFS driver is a kernel component that allows Linux systems to read from and write to disk partitions formatted with the Windows New Technology File System. It enables interoperability, letting servers or workstations access storage devices originally used by Windows operating systems.

What is the slab out-of-bounds read in CVE-2026-80673?

This is a memory safety flaw where the software reads data past the intended end of a memory buffer. Specifically, the NTFS driver fails to properly validate the length of attribute-list entries, causing it to access memory outside the allocated block while parsing a file system structure.

Do I need to be worried about standard network activity?

No. This vulnerability is not triggered by typical network traffic. It requires the Linux kernel to actively mount and parse a specifically manipulated NTFS disk image or storage volume. Simply having a network connection does not trigger this flaw; the system must process the malicious file system structure itself.

Why does Halo Surface Signal categorize this as unlikely?

Halo Surface Signal labels this as 'Very unlikely' because the vulnerability requires a local action, such as mounting an untrusted storage device or malicious image. It is not an internet-facing service or interface, meaning an attacker cannot trigger the flaw remotely through standard network packets.

How should I respond to this vulnerability?

Focus on identifying systems in your environment that mount external or untrusted NTFS volumes. Prioritize these systems for review, as they are the only ones capable of processing the malicious file system structures necessary to trigger the flaw. Coordinate with infrastructure teams to assess if such mounts are essential and verify that security policies restrict mounting unauthorized storage.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.