PT-2026-64857 · Linux · Linux
CVE-2026-64533
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate lcns follow in log replay conversion
log replay() converts DIR PAGE ENTRY 32 records into DIR PAGE ENTRY
records when replaying version 0 restart tables.
During this conversion, the memmove() length is derived directly from
the on-disk lcns follow field:
memmove(&dp->vcn, &dp0->vcn low,
2 * sizeof(u64) +
le32 to cpu(dp->lcns follow) * sizeof(u64));check rstbl() validates restart table structure, but does not constrain
per-entry lcns follow values relative to the entry size. A malformed
filesystem image can provide an oversized lcns follow value, causing
the conversion memmove() to access memory beyond the bounds of the
allocated restart table buffer.
The same field is later used to bound iteration over page lcns[],
so validating lcns follow during conversion also prevents downstream
out-of-bounds access from the same malformed metadata.
Compute the maximum valid lcns follow from the already-validated
restart table entry size and reject entries that exceed this bound.
Reuse the existing t16/t32 scratch variables already declared in
log replay() to avoid introducing new declarations.
[almaz.alexandrovich@paragon-software.com: fixed the conflicts]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux