CVE-2026-64296 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
exfat: bound uniname advance in exfat_find_dir_entry()
In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length:
if (++order == 2) uniname = p_uniname->name; else uniname += EXFAT_FILE_NAME_LEN; len = exfat_extract_uni_name(ep, entry_uniname); name_len += len; unichar = *(uniname+len); *(uniname+len) = 0x0;
uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len grows only by the actual extracted length, which is shorter when a name fragment contains an early NUL. The only guard is `name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short name fragments lets uniname run far past the p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,
causing an out-of-bounds read and write at *(uniname+len).
The sibling extractor exfat_get_uniname_from_ext_entry() already stops on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard added in commit d42334578eba ("exfat: check if filename entries exceeds max filename length")); exfat_find_dir_entry() never got the equivalent. Track the per-entry write offset as a count and reject a fragment once the offset, or the offset plus the extracted length, would exceed MAX_NAME_LENGTH, before forming the output pointer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in the linux kernel's exfat filesystem implementation stems from an improper bounds checking mechanism within the exfat_find_dir_entry() function. This flaw occurs when processing extended filename entries of type TYPE_EXTEND which are used to store long filenames across multiple directory entries. The core issue lies in how the function advances the output pointer for subsequent name fragments while maintaining separate tracking of actual name length versus buffer position advancement.
The technical implementation flaw manifests through inconsistent pointer arithmetic where the uniname pointer increments by a fixed EXFAT_FILE_NAME_LEN value of 15 bytes per entry regardless of actual content length. Meanwhile, the name_len variable only increments by the actual extracted character count from each fragment. This discrepancy creates a scenario where an attacker can craft malicious directory structures containing numerous short name fragments that terminate early with null characters, allowing the uniname pointer to traverse far beyond its allocated buffer boundaries while name_len remains artificially low.
This vulnerability directly maps to CWE-129 Input Validation and bounds checking issues, specifically affecting buffer overflow conditions through improper handling of variable-length data structures. The operational impact represents a critical security risk that could enable attackers to perform out-of-bounds reads and writes, potentially leading to information disclosure or arbitrary code execution depending on memory layout. The flaw particularly affects systems utilizing exfat filesystems where directory traversal operations occur with crafted malicious inputs.
The vulnerability was addressed through enhanced bounds tracking mechanisms that monitor both the cumulative offset position and validate against maximum allowed filename length limits before advancing any output pointer. This fix aligns with defensive programming practices recommended in the ATT&CK framework under TA0005 Defense Evasion and TA0004 Privilege Escalation techniques. The solution mirrors the existing protection pattern implemented in the sibling function exfat_get_uniname_from_ext_entry() which already employed proper lockstep validation between extracted length and buffer boundaries. This correction ensures that filename fragment processing maintains consistent bounds checking across all related filesystem operations, preventing the exploitation vector that allowed crafted directory entries to bypass normal buffer limits and cause memory corruption through out-of-bounds pointer arithmetic.
The fix specifically implements a guard mechanism that rejects filename fragments once either the current offset position or the sum of current offset plus extracted length would exceed MAX_NAME_LENGTH threshold before any pointer advancement occurs. This approach prevents the accumulation of buffer overruns while maintaining compatibility with legitimate filesystem operations and preserving existing functionality for normal directory entry processing scenarios.