CVE-2026-64432
Received Received - Intake

Heap-based Buffer Overflow in Linux Kernel NTFS3 Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass of $LogFile journal replay, log_replay() copies LCNs from each action log record into an existing Dirty Page Table (DPT) entry without bounding the destination index. A crafted NTFS image with DPT entry lcns_follow=1 and an action log record with lcns_follow=2 produces a kernel slab out-of-bounds write at mount time: BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60 Write of size 8 at addr ffff8880095e1040 by task mount Two attacker-controlled fields can drive j+i past the allocated page_lcns[] array: 1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow. 2. lrh->target_vcn may be smaller than dp->vcn, making the u64 subtraction wrap to a huge size_t. Validate target VCN delta and per-record LCN count against the DPT entry capacity, bail via the existing out: cleanup label with -EINVAL. This mirrors the bounds-check pattern added in commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot") and commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in journal-replay file record check").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64432
EUVD
EUVD-2026-48776

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the NTFS3 filesystem driver. It occurs during NTFS journal replay when mounting a crafted filesystem image. The bug allows an attacker to trigger a slab out-of-bounds write in the kernel by manipulating specific fields in the Dirty Page Table and action log records. This leads to a kernel memory corruption issue that could potentially allow arbitrary code execution or system crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem handling. Detection requires checking for kernel logs indicating slab out-of-bounds writes during NTFS mount operations. Monitor dmesg or journalctl for KASAN errors related to log_replay or ntfs3. No direct network detection is applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker with access to craft a malicious NTFS filesystem to gain kernel-level privileges on your system. This could lead to complete system compromise, data theft, or denial of service. The attack requires local access to mount the crafted filesystem, but successful exploitation would give the attacker full control over the affected system.

Mitigation Strategies

Apply the latest Linux kernel security patches addressing this NTFS3 vulnerability. Avoid mounting untrusted NTFS images until patched. If immediate patching is not possible, disable NTFS3 support via kernel configuration or use alternative filesystems for untrusted data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart