CVE-2026-64432

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the analysis pass of $LogFile journal replay, log_replay() copies

LCNs from each action log record into an existing Dirty Page Table

(DPT) entry without bounding the destination index. A crafted NTFS

image with DPT entry lcns_follow=1 and an action log record with

lcns_follow=2 produces a kernel slab out-of-bounds write at mount

time:

BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60

Write of size 8 at addr ffff8880095e1040 by task mount

Two attacker-controlled fields can drive j+i past the allocated

page_lcns[] array:

1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.

2. lrh->target_vcn may be smaller than dp->vcn, making the u64

subtraction wrap to a huge size_t.

Validate target VCN delta and per-record LCN count against the

DPT entry capacity, bail via the existing out: cleanup label with

-EINVAL.

Th

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References