CVE-2026-64533
Received Received - Intake

Buffer Overflow in Linux Kernel NTFS3 Filesystem

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [[email protected]: fixed the conflicts]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64533
EUVD
EUVD-2026-49111

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of the lcns_follow field during log replay in the NTFS3 filesystem. When converting DIR_PAGE_ENTRY_32 records to DIR_PAGE_ENTRY records, the memmove operation uses an unchecked lcns_follow value to determine the length, which can lead to out-of-bounds memory access if the value is too large. This occurs because check_rstbl() does not validate lcns_follow against entry size.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem driver and requires examining kernel logs or filesystem metadata for malformed NTFS images. Detection involves checking for kernel oops or crashes related to NTFS3 operations, particularly during filesystem mounting or log replay. Use 'dmesg | grep ntfs3' to inspect kernel logs for NTFS3-related errors.

Impact Analysis

This vulnerability could allow an attacker with access to craft a malformed NTFS filesystem image to trigger memory corruption or crashes in the Linux kernel. This might lead to denial-of-service conditions or potentially privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level filesystem bug in the Linux kernel. Standards like GDPR and HIPAA focus on data protection, access controls, and breach notification rather than kernel memory safety issues.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor for any suspicious filesystem activity or crashes that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64533. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart