# CVE-2026-80672: linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs: fix u16 truncation of restart-area length...

CVE-2026-80672 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80672 (version 7.1.5-1), released August 29, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-80672
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 28, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  ntfs: fix u16 truncation of restart-area length check  ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size:          u16 ra_ofs, ra_len, ca_ofs;         ...         ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *                         sizeof(struct log_client_record);         if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...)                 return false;  ra_len is u16, but the right-hand side is computed in size_t (sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients come straight from the on-disk restart area. With an on-disk log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64 gives ra_len 128), so the "fits in the page" check passes even though the client array described by log_clients extends far beyond the page.  ntfs_check_log_client_array() then walks the array bounded only by the on-disk log_clients count:          cr = ca + idx;         if (cr->prev_client != LOGFILE_NO_CLIENT) ...  For log_clients 410 it dereferences records up to ca + 409 * 160, ~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an out-of-bounds read of attacker-controlled extent, reachable when a crafted NTFS image is mounted (load_and_check_logfile() at mount time). This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g userspace driver but never in this revived classic driver.  Compute the restart-area length in a u32 so the existing bounds check rejects an over-large client array instead of being defeated by the truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded from __le16 on-disk fields and every comparison already promotes to int/size_t, so this changes no result and keeps the declaration uniform.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-80672](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80672.md) | Aug 29, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.