{"id":"CVE-2026-64431","state":"PUBLISHED","title":"ntfs: avoid calling post_write_mst_fixup() for invalid index_block","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid calling post_write_mst_fixup() for invalid index_block\n\nntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()\nreturns an error, intending to restore the buffer after a failed write.\n\nHowever, ntfs_ib_write() returns an error immediately if\npre_write_mst_fixup() validation fails. The caller,\nntfs_icx_ib_sync_write(), interprets any error as a write failure\nrequiring rollback. It does not differentiate between I/O errors and\nvalidation failures, and calls post_write_mst_fixup() anyway.\n\nSince post_write_mst_fixup() assumes that the index_block contents is\ncorrect, it doesn't perform the boundary checks, which results in\nout-of-bounds memory access.\n\nAn attacker can craft a malicious NTFS image with:\n  - large index_block.usa_ofs offset, pointing outside the ntfs_record\n  - index_block.usa_count = 0, causing integer underflow\n  - or index_block.usa_count larger than actual number of sectors in the\n    ntfs_record, causing out-of-bounds access\n\nKASAN reports describing the memory corruption:\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0\n  Read of size 2 at addr ffff8881586c9018 by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x19c/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x19c/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x19c/0x1d0\n   post_write_mst_fixup+0x19c/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x1aa/0x1d0\n  Write of size 2 at addr ffff8881586c91fe by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   post_write_mst_fixup+0x1aa/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n\nLet's move the post_write_mst_fixup() call to ntfs_ib_write().\nThe ntfs_ib_write() function calls pre_write_mst_fixup() at the beginning.\nIf the index_block contents is invalid, pre_write_mst_fixup() fails and\nntfs_ib_write() returns early without calling post_write_mst_fixup() on\nbad index_block.","publishedAt":"2026-07-25T08:51:07.194Z","updatedAt":"2026-08-17T04:55:32.047Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0","status":"affected","lessThan":"e2018628301a6d9f54e34b0cb417f1688c66df1d","versionType":"git"},{"version":"0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0","status":"affected","lessThan":"5b6eedd7cc2936f9238e852b553a1b326105bde8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/index.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/index.c"]}],"references":["https://git.kernel.org/stable/c/e2018628301a6d9f54e34b0cb417f1688c66df1d","https://git.kernel.org/stable/c/5b6eedd7cc2936f9238e852b553a1b326105bde8"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64431.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64431","state":"PUBLISHED","datePublished":"2026-07-25T08:51:07.194Z","dateUpdated":"2026-08-17T04:55:32.047Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.787Z"},"containers":{"cna":{"title":"ntfs: avoid calling post_write_mst_fixup() for invalid index_block","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid calling post_write_mst_fixup() for invalid index_block\n\nntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()\nreturns an error, intending to restore the buffer after a failed write.\n\nHowever, ntfs_ib_write() returns an error immediately if\npre_write_mst_fixup() validation fails. The caller,\nntfs_icx_ib_sync_write(), interprets any error as a write failure\nrequiring rollback. It does not differentiate between I/O errors and\nvalidation failures, and calls post_write_mst_fixup() anyway.\n\nSince post_write_mst_fixup() assumes that the index_block contents is\ncorrect, it doesn't perform the boundary checks, which results in\nout-of-bounds memory access.\n\nAn attacker can craft a malicious NTFS image with:\n  - large index_block.usa_ofs offset, pointing outside the ntfs_record\n  - index_block.usa_count = 0, causing integer underflow\n  - or index_block.usa_count larger than actual number of sectors in the\n    ntfs_record, causing out-of-bounds access\n\nKASAN reports describing the memory corruption:\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0\n  Read of size 2 at addr ffff8881586c9018 by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x19c/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x19c/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x19c/0x1d0\n   post_write_mst_fixup+0x19c/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x1aa/0x1d0\n  Write of size 2 at addr ffff8881586c91fe by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   post_write_mst_fixup+0x1aa/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n\nLet's move the post_write_mst_fixup() call to ntfs_ib_write().\nThe ntfs_ib_write() function calls pre_write_mst_fixup() at the beginning.\nIf the index_block contents is invalid, pre_write_mst_fixup() fails and\nntfs_ib_write() returns early without calling post_write_mst_fixup() on\nbad index_block."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0","status":"affected","lessThan":"e2018628301a6d9f54e34b0cb417f1688c66df1d","versionType":"git"},{"version":"0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0","status":"affected","lessThan":"5b6eedd7cc2936f9238e852b553a1b326105bde8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/index.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/index.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e2018628301a6d9f54e34b0cb417f1688c66df1d"},{"url":"https://git.kernel.org/stable/c/5b6eedd7cc2936f9238e852b553a1b326105bde8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The malformed USA fields originate in a crafted NTFS volume, and exploitation proceeds through local file modification followed by fsync or writeback. Network file access alone cannot create the required malformed index metadata.\nAC:L - The attacker controls the index block, USA offset/count, target filename, and triggering operation; no race or condition outside attacker control is required. The usa_count underflow provides a deterministic corruption path.\nPR:L - Although a direct NTFS mount requires initial-namespace CAP_SYS_ADMIN because NTFS lacks FS_USERNS_MOUNT, delegated or automatic mounting allows an ordinary local user to reach the trigger. After mounting, only write access to the crafted file is needed and no capability check occurs.\nUI:N - In reasonable automount, delegated-mount, or fstab-user deployments, no separate victim action is required. The attacker can mount or access the volume, modify the writable file, and invoke fsync independently.\nS:U - The corruption occurs in the host kernel and compromises resources governed by that same kernel security authority. This is standard local kernel privilege escalation rather than a guest-to-host or IOMMU boundary escape.\nC:H - Unchecked USA metadata causes substantial out-of-bounds reads, and the accompanying kernel heap corruption can be leveraged to disclose arbitrary kernel memory. The reads are not confined to a small bounded value.\nI:H - An underflowed usa_count produces up to 65,535 two-byte writes at 512-byte intervals, spanning roughly 32 MiB beyond the index-block allocation. Attacker-controlled initial source values and heap grooming make control-flow hijacking or arbitrary kernel modification defensible.\nA:H - The extensive out-of-bounds access can corrupt unrelated kernel objects or access invalid memory, causing an oops, panic, or system-wide failure. The trigger is repeatable through local filesystem operations."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:55:32.047Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}