Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfs_check_restart_area()… (CVE-2026-80672)

The Linux kernel's NTFS driver contained a vulnerability where the restart-area length check in ntfs_check_restart_area() used a 16-bit variable (u16) to store a length computed as a product of a count and a structure size, which can exceed 16 bits. This truncation causes the bounds check to incorrectly pass, allowing ntfs_check_log_client_array() to read beyond the allocated buffer by up to ~64 KiB when mounting a maliciously crafted NTFS image. The root cause is the use of u16 for ra_len, which should be widened to u32 to prevent truncation and ensure the bounds check correctly rejects oversized client arrays. This vulnerability is an in-kernel analogue of CVE-2022-30789, previously fixed in the ntfs-3g userspace driver but not in the kernel driver until this fix.

Successful exploitation allows an attacker with local privileges to mount a crafted NTFS filesystem image that triggers an out-of-bounds read in kernel memory. This can lead to information disclosure, kernel memory corruption, and potentially privilege escalation or denial of service. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability with low attack complexity and limited privileges required.

A fix has been implemented in the Linux kernel to widen the variables involved in the restart-area length calculation from u16 to u32, preventing truncation and ensuring proper bounds checking. Users should update to the patched kernel version containing this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigations are indicated by the vendor advisory.