PT-2026-64856 · Linux · Linux
CVE-2026-64532
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound NTFS DE view.data off in UpdateRecordData{Root,Allocation}
In do action()'s UpdateRecordDataRoot (fslog.c:3489) and
UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove
destination is
Add2Ptr(e, le16 to cpu(e->view.data off)),
where e->view.data off comes from an on-disk NTFS DE inside
an INDEX ROOT or INDEX BUFFER. Neither case validates
view.data off + dlen against e->size; the existing
check if index root / check if alloc index helpers walk the
entry chain and validate the entry's offset, but not its
internal view fields.The neighbouring read sites (e.g., fs/ntfs3/index.c when
iterating view entries) check view.data off + view.data size
<= e->size. Apply the same bound at the two memmove sites.
Reproduced under UML+KASAN on mainline 8d90b09e6741 via
pr warn-only probe instrumentation: with view.data off forced
to 0xFFFC, the memmove writes 32 bytes past the end of the
NTFS DE.
This is similar in shape to Pavitra Jha's 2026-05-02 patch
"fs/ntfs3: prevent oob in case UpdateRecordDataRoot"
(20260502105008.21827-1-jhapavitra98@gmail.com) which
proposes calling ntfs3 bad de range(); that helper does not
exist in mainline. This patch uses inline checks.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux