CVE-2026-80598

ntfs3: fix out-of-bounds read in decompress_lznt

State: Published
Severity: 7.8 High
Published: Aug 28, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix out-of-bounds read in decompress_lznt

decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.

Add index bounds checking to prevent the OOB access.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	522e010b58379fbe19b38fdef5016bca0c3cf405 to before 1113fa5b01a47a1a4cdbb9c695197ca6215f02a8Affected 522e010b58379fbe19b38fdef5016bca0c3cf405 to before 61415ffa365d2eca6986914afd0d1412444aa1ddAffected 522e010b58379fbe19b38fdef5016bca0c3cf405 to before bd77afca2ae9b6d44d37902e3ad672ebb028b070Affected 522e010b58379fbe19b38fdef5016bca0c3cf405 to before c694f8ea2611e7413b3f04ee47e04a9b7b45817bAffected 522e010b58379fbe19b38fdef5016bca0c3cf405 to before ff05a98150ebb2b03919a9c05c576681e86abbb7Affected 522e010b58379fbe19b38fdef5016bca0c3cf405 to before a93980141253c932aa6ae5d4422d90e0162dc774Affected 522e010b58379fbe19b38fdef5016bca0c3cf405 to before 7160a57192fb16d7a6fa9b7f5c7ac341d2444a89Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

522e010b58379fbe19b38fdef5016bca0c3cf405 to before 1113fa5b01a47a1a4cdbb9c695197ca6215f02a8Affected
522e010b58379fbe19b38fdef5016bca0c3cf405 to before 61415ffa365d2eca6986914afd0d1412444aa1ddAffected
522e010b58379fbe19b38fdef5016bca0c3cf405 to before bd77afca2ae9b6d44d37902e3ad672ebb028b070Affected
522e010b58379fbe19b38fdef5016bca0c3cf405 to before c694f8ea2611e7413b3f04ee47e04a9b7b45817bAffected
522e010b58379fbe19b38fdef5016bca0c3cf405 to before ff05a98150ebb2b03919a9c05c576681e86abbb7Affected
522e010b58379fbe19b38fdef5016bca0c3cf405 to before a93980141253c932aa6ae5d4422d90e0162dc774Affected
522e010b58379fbe19b38fdef5016bca0c3cf405 to before 7160a57192fb16d7a6fa9b7f5c7ac341d2444a89Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.