PT-2026-64652 · Linux · Linux
CVE-2026-64431
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ntfs: avoid calling post write mst fixup() for invalid index block
ntfs icx ib sync write() calls post write mst fixup() when ntfs ib write()
returns an error, intending to restore the buffer after a failed write.
However, ntfs ib write() returns an error immediately if
pre write mst fixup() validation fails. The caller,
ntfs icx ib sync write(), interprets any error as a write failure
requiring rollback. It does not differentiate between I/O errors and
validation failures, and calls post write mst fixup() anyway.
Since post write mst fixup() assumes that the index block contents is
correct, it doesn't perform the boundary checks, which results in
out-of-bounds memory access.
An attacker can craft a malicious NTFS image with:
- large index block.usa ofs offset, pointing outside the ntfs record
- index block.usa count = 0, causing integer underflow
- or index block.usa count larger than actual number of sectors in the ntfs record, causing out-of-bounds access
KASAN reports describing the memory corruption:
BUG: KASAN: slab-out-of-bounds in post write mst fixup+0x19c/0x1d0 Read of size 2 at addr ffff8881586c9018 by task p/9428 Call Trace: dump stack lvl+0x100/0x190 print report+0x139/0x4ad ? post write mst fixup+0x19c/0x1d0 ? virt addr valid+0x262/0x500 ? post write mst fixup+0x19c/0x1d0 kasan report+0xe4/0x1d0 ? post write mst fixup+0x19c/0x1d0 post write mst fixup+0x19c/0x1d0 ntfs icx ib sync write+0x179/0x220 ntfs inode sync filename+0x83d/0x1080 ntfs write inode+0x1049/0x1480 ntfs file fsync+0x131/0x9b0
BUG: KASAN: slab-out-of-bounds in post write mst fixup+0x1aa/0x1d0 Write of size 2 at addr ffff8881586c91fe by task p/9428 Call Trace: dump stack lvl+0x100/0x190 print report+0x139/0x4ad ? post write mst fixup+0x1aa/0x1d0 ? virt addr valid+0x262/0x500 ? post write mst fixup+0x1aa/0x1d0 kasan report+0xe4/0x1d0 ? post write mst fixup+0x1aa/0x1d0 post write mst fixup+0x1aa/0x1d0 ntfs icx ib sync write+0x179/0x220 ntfs inode sync filename+0x83d/0x1080 ntfs write inode+0x1049/0x1480 ntfs file fsync+0x131/0x9b0
Let's move the post write mst fixup() call to ntfs ib write().
The ntfs ib write() function calls pre write mst fixup() at the beginning.
If the index block contents is invalid, pre write mst fixup() fails and
ntfs ib write() returns early without calling post write mst fixup() on
bad index block.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux