CVE-2026-64532
Received Received - Intake

Buffer Overflow in Linux Kernel NTFS3 Filesystem

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e->size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size <= e->size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" (<[email protected]>) which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64532
EUVD
EUVD-2026-49110

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's NTFS3 file system driver. It involves a missing bounds check when handling NTFS directory entry data offsets. Specifically, the code fails to validate that the data offset plus data length does not exceed the entry size before performing a memory move operation. This can lead to out-of-bounds writes when processing corrupted NTFS file system structures.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem driver and requires kernel-level detection. Monitor kernel logs for memory corruption warnings or crashes related to NTFS3 operations. Use tools like dmesg or journalctl to check for kernel oops or warnings after mounting or accessing NTFS volumes.

Impact Analysis

This vulnerability could allow an attacker with access to craft a malicious NTFS file system image to trigger kernel memory corruption. This might result in system crashes, data corruption, or potentially privilege escalation if exploited. Users relying on systems with unpatched Linux kernels using NTFS3 are at risk.

Compliance Impact

This vulnerability involves an out-of-bounds memory write in the Linux kernel's NTFS3 filesystem driver, which could lead to memory corruption or crashes. While the description does not explicitly mention compliance impacts, such low-level memory corruption vulnerabilities can potentially affect data integrity and security controls required by standards like GDPR and HIPAA.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. Avoid mounting untrusted NTFS volumes until patched. If immediate patching is not possible, disable the NTFS3 driver by blacklisting it or using an alternative filesystem for affected volumes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart