{"id":"CVE-2026-64533","state":"PUBLISHED","title":"fs/ntfs3: validate lcns_follow in log_replay conversion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate lcns_follow in log_replay conversion\n\nlog_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY\nrecords when replaying version 0 restart tables.\n\nDuring this conversion, the memmove() length is derived directly from\nthe on-disk lcns_follow field:\n\n\tmemmove(&dp->vcn, &dp0->vcn_low,\n\t\t2 * sizeof(u64) +\n\t\t\t\tle32_to_cpu(dp->lcns_follow) * sizeof(u64));\n\ncheck_rstbl() validates restart table structure, but does not constrain\nper-entry lcns_follow values relative to the entry size. A malformed\nfilesystem image can provide an oversized lcns_follow value, causing\nthe conversion memmove() to access memory beyond the bounds of the\nallocated restart table buffer.\n\nThe same field is later used to bound iteration over page_lcns[],\nso validating lcns_follow during conversion also prevents downstream\nout-of-bounds access from the same malformed metadata.\n\nCompute the maximum valid lcns_follow from the already-validated\nrestart table entry size and reject entries that exceed this bound.\nReuse the existing t16/t32 scratch variables already declared in\nlog_replay() to avoid introducing new declarations.\n\n[almaz.alexandrovich@paragon-software.com: fixed the conflicts]","publishedAt":"2026-07-27T06:32:33.740Z","updatedAt":"2026-10-19T20:48:38.720Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"ca343a99806b4fc8e27c48f08be3445c5fcd1445","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"ddfc8683e1a627dbf1b83bacf8961443dd654258","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"57c071e2c4f30b9c6f5aacb6679aab1269fbae99","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"159f694d682e4215b3822ae31ed3a4631628fe55","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"7adb38279812c9c06b0e3fa7382f4d7887f3fa2d","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"32b9f8733feb241627fa5f564b1a99b5cae974c5","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"6a4c53a2e26a865565bd6a460961e8d6fcb32329","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"]}],"references":["https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445","https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258","https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99","https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55","https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d","https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5","https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64533.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64533","state":"PUBLISHED","datePublished":"2026-07-27T06:32:33.740Z","dateUpdated":"2026-10-19T20:48:38.720Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.795Z"},"containers":{"cna":{"title":"fs/ntfs3: validate lcns_follow in log_replay conversion","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate lcns_follow in log_replay conversion\n\nlog_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY\nrecords when replaying version 0 restart tables.\n\nDuring this conversion, the memmove() length is derived directly from\nthe on-disk lcns_follow field:\n\n\tmemmove(&dp->vcn, &dp0->vcn_low,\n\t\t2 * sizeof(u64) +\n\t\t\t\tle32_to_cpu(dp->lcns_follow) * sizeof(u64));\n\ncheck_rstbl() validates restart table structure, but does not constrain\nper-entry lcns_follow values relative to the entry size. A malformed\nfilesystem image can provide an oversized lcns_follow value, causing\nthe conversion memmove() to access memory beyond the bounds of the\nallocated restart table buffer.\n\nThe same field is later used to bound iteration over page_lcns[],\nso validating lcns_follow during conversion also prevents downstream\nout-of-bounds access from the same malformed metadata.\n\nCompute the maximum valid lcns_follow from the already-validated\nrestart table entry size and reject entries that exceed this bound.\nReuse the existing t16/t32 scratch variables already declared in\nlog_replay() to avoid introducing new declarations.\n\n[almaz.alexandrovich@paragon-software.com: fixed the conflicts]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"ca343a99806b4fc8e27c48f08be3445c5fcd1445","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"ddfc8683e1a627dbf1b83bacf8961443dd654258","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"57c071e2c4f30b9c6f5aacb6679aab1269fbae99","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"159f694d682e4215b3822ae31ed3a4631628fe55","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"7adb38279812c9c06b0e3fa7382f4d7887f3fa2d","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"32b9f8733feb241627fa5f564b1a99b5cae974c5","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","status":"affected","lessThan":"6a4c53a2e26a865565bd6a460961e8d6fcb32329","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445"},{"url":"https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258"},{"url":"https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99"},{"url":"https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55"},{"url":"https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d"},{"url":"https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5"},{"url":"https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The NTFS3 parser consumes malicious metadata from a locally mounted block device or filesystem image, not directly through a network protocol.\nAC:L - A structurally valid 44-byte entry with attacker-controlled lcns_follow=2 already crosses the heap-buffer boundary. No race or uncontrollable condition is required.\nPR:N - The attacker needs no account or capability to prepare and supply the crafted image; the init-namespace CAP_SYS_ADMIN mount requirement applies to the interacting victim or privileged mounting helper.\nUI:R - A victim or trusted mounting helper must cause the crafted NTFS filesystem to be mounted before journal replay processes the malicious metadata.\nS:U - The corruption compromises the kernel processing its own filesystem metadata and does not cross a distinct security authority such as a guest-to-host boundary.\nC:H - The attacker-controlled memmove performs a heap out-of-bounds read of attacker-selected extent, and the resulting memory corruption can be leveraged to disclose kernel memory.\nI:H - The same memmove writes beyond the allocated restart-table buffer, allowing corruption of adjacent slab objects and potentially arbitrary writes or control-flow hijacking.\nA:H - A sufficiently large lcns_follow reliably drives the kernel into an extensive invalid memory access, causing an oops or panic during mount and permitting repeated denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:57:11.184Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64533","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:41:51.439492Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:48:38.720Z"}}]}}}