CVE-2026-64533 in Linux
Summary
by MITRE • 07/27/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate lcns_follow in log_replay conversion
log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables.
During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field:
memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64));
check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer.
The same field is later used to bound iteration over page_lcns[],
so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata.
Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations.
[[email protected]: fixed the conflicts]
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability resides in the linux kernel's ntfs3 filesystem driver where a critical buffer overflow occurs during log replay operations when processing directory page entries. This flaw manifests specifically within the log_replay() function which handles conversion of DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY format during restart table recovery processes. The technical implementation directly utilizes an unvalidated on-disk field called lcns_follow to determine memory copy boundaries through memmove() operations, creating a classic buffer over-read condition that can lead to arbitrary code execution or system instability.
The root cause stems from insufficient validation of the lcns_follow field within the restart table structure validation performed by check_rstbl(). While this function ensures overall restart table integrity, it fails to impose bounds checking on individual entry fields relative to their allocated memory boundaries. This oversight allows maliciously crafted filesystem images to specify oversized lcns_follow values that exceed the actual buffer capacity, enabling attackers to manipulate memory access patterns beyond legitimate data boundaries. The vulnerability directly maps to CWE-121 heap-based buffer overflow conditions and aligns with ATT&CK technique T1059.008 for execution through kernel code manipulation.
The operational impact extends beyond simple memory corruption as the same malformed lcns_follow field is subsequently used to control loop iteration bounds when accessing page_lcns[] arrays, creating cascading effects that compound the initial vulnerability. This multi-stage exploitation potential means that a single malformed entry can trigger multiple out-of-bounds memory accesses throughout the recovery process. The fix implements proper validation by computing maximum allowable lcns_follow values based on already-validated restart table entry sizes and rejects entries exceeding these calculated bounds, preventing both immediate buffer overflows and subsequent downstream access violations.
The mitigation strategy specifically leverages existing t16/t32 scratch variables within log_replay() function scope to avoid introducing new memory allocations or complex validation logic. This approach maintains code simplicity while ensuring comprehensive protection against the vulnerability class. The solution directly addresses the memory safety issue by establishing proper bounds checking during the conversion process, preventing attackers from exploiting malformed filesystem metadata to achieve unauthorized memory access patterns. Implementation follows security best practices by validating inputs before use and applying defensive programming principles to prevent cascading failures in kernel space operations.