CVE-2026-64532

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and

UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove

destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,

where e->view.data_off comes from an on-disk NTFS_DE inside

an INDEX_ROOT or INDEX_BUFFER. Neither case validates

view.data_off + dlen against e->size; the existing

check_if_index_root / check_if_alloc_index helpers walk the

entry chain and validate the entry's offset, but not its

internal view fields.

The neighbouring read sites (e.g., fs/ntfs3/index.c when

iterating view entries) check view.data_off + view.data_size

<= e->size. Apply the same bound at the two memmove sites.

Reproduced under UML+KASAN on mainline 8d90b09e6741 via

pr_warn-only probe instrumentation: with view.data_off forced

to 0xFFFC, the memmove writes 32 bytes past the end of the

NTFS_DE.

This

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References