CVE-2026-64431 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: avoid calling post_write_mst_fixup() for invalid index_block
ntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write() returns an error, intending to restore the buffer after a failed write.
However, ntfs_ib_write() returns an error immediately if pre_write_mst_fixup() validation fails. The caller, ntfs_icx_ib_sync_write(), interprets any error as a write failure requiring rollback. It does not differentiate between I/O errors and validation failures, and calls post_write_mst_fixup() anyway.
Since post_write_mst_fixup() assumes that the index_block contents is correct, it doesn't perform the boundary checks, which results in out-of-bounds memory access.
An attacker can craft a malicious NTFS image with: - large index_block.usa_ofs offset, pointing outside the ntfs_record - index_block.usa_count = 0, causing integer underflow - or index_block.usa_count larger than actual number of sectors in the ntfs_record, causing out-of-bounds access
KASAN reports describing the memory corruption: ================================================================== BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0 Read of size 2 at addr ffff8881586c9018 by task p/9428 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 print_report+0x139/0x4ad ? post_write_mst_fixup+0x19c/0x1d0 ? __virt_addr_valid+0x262/0x500 ? post_write_mst_fixup+0x19c/0x1d0 kasan_report+0xe4/0x1d0 ? post_write_mst_fixup+0x19c/0x1d0 post_write_mst_fixup+0x19c/0x1d0 ntfs_icx_ib_sync_write+0x179/0x220 ntfs_inode_sync_filename+0x83d/0x1080 __ntfs_write_inode+0x1049/0x1480 ntfs_file_fsync+0x131/0x9b0 ================================================================== BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x1aa/0x1d0 Write of size 2 at addr ffff8881586c91fe by task p/9428 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 print_report+0x139/0x4ad ? post_write_mst_fixup+0x1aa/0x1d0 ? __virt_addr_valid+0x262/0x500 ? post_write_mst_fixup+0x1aa/0x1d0 kasan_report+0xe4/0x1d0 ? post_write_mst_fixup+0x1aa/0x1d0 post_write_mst_fixup+0x1aa/0x1d0 ntfs_icx_ib_sync_write+0x179/0x220 ntfs_inode_sync_filename+0x83d/0x1080 __ntfs_write_inode+0x1049/0x1480 ntfs_file_fsync+0x131/0x9b0 ==================================================================
Let's move the post_write_mst_fixup() call to ntfs_ib_write(). The ntfs_ib_write() function calls pre_write_mst_fixup() at the beginning. If the index_block contents is invalid, pre_write_mst_fixup() fails and ntfs_ib_write() returns early without calling post_write_mst_fixup() on bad index_block.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical memory corruption flaw in the Linux kernel's NTFS file system implementation that stems from improper error handling and validation logic within the index block synchronization functions. This issue manifests when the ntfs_icx_ib_sync_write() function processes index blocks that have been corrupted or maliciously constructed, leading to out-of-bounds memory access patterns that can result in system instability or potential privilege escalation. The root cause lies in the kernel's failure to distinguish between different types of error conditions during file system operations, specifically between I/O errors and validation failures that should not trigger rollback mechanisms.
The technical flaw occurs within the ntfs_inode_sync_filename() function chain where ntfs_icx_ib_sync_write() is invoked to synchronize index block data. When ntfs_ib_write() encounters a pre_write_mst_fixup() validation failure, it immediately returns an error code without performing any write operations. However, the calling function ntfs_icx_ib_sync_write() treats all errors identically and proceeds to invoke post_write_mst_fixup() regardless of whether the error originated from a failed write operation or a validation failure. This inappropriate behavior leads to post_write_mst_fixup() attempting to process index_block structures that contain invalid metadata, specifically when the index_block.usa_ofs offset points beyond valid ntfs_record boundaries or when index_block.usa_count values cause integer underflows or out-of-bounds access conditions.
The security implications of this vulnerability align with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, as the flaw allows attackers to craft malicious NTFS images that exploit the kernel's improper error handling mechanism. The KASAN memory corruption reports clearly demonstrate the out-of-bounds access patterns with read and write operations of size 2 occurring at addresses within the ntfs_record structure, indicating direct memory corruption in the kernel's virtual address space. This vulnerability can be exploited through the ATT&CK technique T1059 Command and Scripting Interpreter when combined with file system manipulation attacks, potentially allowing adversaries to achieve arbitrary code execution or denial of service conditions.
The proposed fix addresses this issue by moving the post_write_mst_fixup() call into the ntfs_ib_write() function itself, which ensures that this rollback mechanism is only invoked for legitimate write operations that have successfully passed validation checks. This approach prevents the problematic scenario where invalid index_block structures trigger memory corruption during cleanup operations, thereby eliminating the out-of-bounds access conditions that occur when post_write_mst_fixup() assumes valid index_block contents without proper boundary verification. The solution follows secure coding principles by ensuring proper error classification and handling within the kernel's file system subsystem, reducing attack surface and preventing potential privilege escalation opportunities through memory corruption exploitation.