{
  "cveId": "CVE-2026-80672",
  "url": "https://patchblox.com/security/cve/CVE-2026-80672",
  "summary": "CVE-2026-80672 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80672 (version 7.1.5-1), released August 29, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs: fix u16 truncation of restart-area length...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: fix u16 truncation of restart-area length check  ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size:          u16 ra_ofs, ra_len, ca_ofs;         ...         ra_len = ca_ofs \u002B le16_to_cpu(ra-\u003Elog_clients) *                         sizeof(struct log_client_record);         if (ra_ofs \u002B ra_len \u003E le32_to_cpu(rp-\u003Esystem_page_size) || ...)                 return false;  ra_len is u16, but the right-hand side is computed in size_t (sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients come straight from the on-disk restart area. With an on-disk log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64 gives ra_len 128), so the \u0022fits in the page\u0022 check passes even though the client array described by log_clients extends far beyond the page.  ntfs_check_log_client_array() then walks the array bounded only by the on-disk log_clients count:          cr = ca \u002B idx;         if (cr-\u003Eprev_client != LOGFILE_NO_CLIENT) ...  For log_clients 410 it dereferences records up to ca \u002B 409 * 160, ~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an out-of-bounds read of attacker-controlled extent, reachable when a crafted NTFS image is mounted (load_and_check_logfile() at mount time). This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g userspace driver but never in this revived classic driver.  Compute the restart-area length in a u32 so the existing bounds check rejects an over-large client array instead of being defeated by the truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded from __le16 on-disk fields and every comparison already promotes to int/size_t, so this changes no result and keeps the declaration uniform.",
  "published": "2026-08-28T08:16:52Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00165,
  "epssPercentile": 0.05752,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-80672",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80672",
      "released": "2026-08-29T00:46:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}