CVE-2026-64431

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid calling post_write_mst_fixup() for invalid index_block

ntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()

returns an error, intending to restore the buffer after a failed write.

However, ntfs_ib_write() returns an error immediately if

pre_write_mst_fixup() validation fails. The caller,

ntfs_icx_ib_sync_write(), interprets any error as a write failure

requiring rollback. It does not differentiate between I/O errors and

validation failures, and calls post_write_mst_fixup() anyway.

Since post_write_mst_fixup() assumes that the index_block contents is

correct, it doesn't perform the boundary checks, which results in

out-of-bounds memory access.

An attacker can craft a malicious NTFS image with:

- large index_block.usa_ofs offset, pointing outside the ntfs_record

- index_block.usa_count = 0, causing integer underflow

- or index_block.usa_count larger than actual number of secto

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References