{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: bound the attribute-list entry in ntfs_read_inode_mount()  The $MFT attribute-list walk in ntfs_read_inode_mount() validates each entry only with \"(u8 *)al_entry + 6 \u003e al_end\" and \"(u8 *)al_entry + le16_to_cpu(al_entry-\u003elength) \u003e al_end\", but then reads al_entry-\u003elowest_vcn (an __le64 at offset 8) and al_entry-\u003emft_reference (offset 16) -- fields beyond the 6 bytes proven in range. al_entry-\u003elength is attacker-controlled and only required non-zero, so a short entry (e.g. length 8) placed at the tail passes both checks while the lowest_vcn / mft_reference reads fall past al_end.  al_end is ni-\u003eattr_list + attr_list_size (the on-disk size); the buffer is kvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding usually absorbs the over-read -- but when attr_list_size is a multiple of SECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an out-of-bounds read at mount time.  Validate the entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing it, matching the bound the other attribute-list walks now use. The validator already requires the length to cover the fixed header, which makes the separate \"!al_entry-\u003elength\" check redundant, so drop it too.",
  "id": "DEBIAN-CVE-2026-80869",
  "modified": "2026-09-14T16:47:47.873656025Z",
  "published": "2026-09-04T17:16:58.750Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80869"
    }
  ],
  "upstream": [
    "CVE-2026-80869"
  ]
}