CVE-2026-80868: ntfs3: Allocate iomap inline_data using alloc_page

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-04

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Allocate iomap inline_data using alloc_page This fixes a BUG reported in iomap_write_end_inline: iomap_inline_data_valid checks that the inline_data fits within a page. If the inline_data is allocated with kmemdup there's no guarantee that it's page-aligned, so the check sometimes fails. Allocate it with alloc_page to ensure it's page-aligned.

Affected products

Linux kernel: 7.0 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/3cd2212012c06d2b1fd03a6bf84f6202ab70056c
https://git.kernel.org/stable/c/70d3855594cf6e8791970714b65cac3202d6160e

Get alerted when CVE-2026-80868 or the next vulnerability affects your stack