CVE-2026-64432 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
In the analysis pass of $LogFile journal replay, log_replay() copies LCNs from each action log record into an existing Dirty Page Table (DPT) entry without bounding the destination index. A crafted NTFS image with DPT entry lcns_follow=1 and an action log record with lcns_follow=2 produces a kernel slab out-of-bounds write at mount time:
BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60 Write of size 8 at addr ffff8880095e1040 by task mount
Two attacker-controlled fields can drive j+i past the allocated page_lcns[] array:
1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow. 2. lrh->target_vcn may be smaller than dp->vcn, making the u64 subtraction wrap to a huge size_t.
Validate target VCN delta and per-record LCN count against the DPT entry capacity, bail via the existing out: cleanup label with -EINVAL.
This mirrors the bounds-check pattern added in commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot") and commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in journal-replay file record check").
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides within the ntfs3 filesystem driver of the Linux kernel, specifically during the $LogFile journal replay process where the log_replay() function handles recovery operations. This flaw occurs when processing action log records that contain LCN (Logical Cluster Number) information, which are copied into an existing Dirty Page Table (DPT) entry without proper bounds validation on the destination index. The core issue manifests as a slab-out-of-bounds write condition that can be triggered during filesystem mount operations.
The technical implementation flaw stems from inadequate input validation when copying LCN data between different structures within the journal replay mechanism. An attacker can craft a malicious NTFS image where a DPT entry has lcns_follow=1 while an action log record contains lcns_follow=2, creating a scenario where the destination array index calculation becomes invalid. Additionally, when lrh->target_vcn is smaller than dp->vcn, the resulting u64 subtraction produces an enormous size_t value that overflows the allocated page_lcns[] array boundaries.
This vulnerability directly maps to CWE-129, which describes insufficient bounds checking of array data, and can be categorized under ATT&CK technique T1059.003 for execution through kernel-level code manipulation. The out-of-bounds write condition occurs at mount time when the kernel attempts to replay journal entries, making it a critical pre-authentication vulnerability that could lead to privilege escalation or system instability.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a potential path for attackers to achieve arbitrary code execution within kernel space through carefully crafted filesystem images. The vulnerability affects systems running Linux kernels with ntfs3 filesystem support and can be exploited by any user who has the ability to mount malicious NTFS volumes or manipulate filesystem structures.
The fix implements bounds checking validation that compares the target VCN delta against the DPT entry capacity, ensuring that the destination array index remains within valid bounds before performing any memory operations. This solution follows established patterns within the kernel codebase, mirroring previous fixes for similar issues in the same subsystem, specifically referencing commits that implemented comparable validation mechanisms for other journal replay functions. The implementation uses the existing error handling infrastructure with a -EINVAL return code and cleanup label to ensure proper resource management when validation fails.
The mitigation strategy focuses on input validation at the point of data transfer between different kernel structures, ensuring that all array access operations respect allocated memory boundaries. This defensive programming approach prevents attackers from exploiting the arithmetic overflow conditions that lead to memory corruption. The solution maintains backward compatibility while strengthening the kernel's resilience against malicious filesystem content through explicit bounds checking that aligns with established kernel security practices and follows the principle of least privilege in memory management operations.