CVE-2026-64533

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate lcns_follow in log_replay conversion

log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY

records when replaying version 0 restart tables.

During this conversion, the memmove() length is derived directly from

the on-disk lcns_follow field:

memmove(&dp->vcn, &dp0->vcn_low,

2 * sizeof(u64) +

le32_to_cpu(dp->lcns_follow) * sizeof(u64));

check_rstbl() validates restart table structure, but does not constrain

per-entry lcns_follow values relative to the entry size. A malformed

filesystem image can provide an oversized lcns_follow value, causing

the conversion memmove() to access memory beyond the bounds of the

allocated restart table buffer.

The same field is later used to bound iteration over page_lcns[],

so validating lcns_follow during conversion also prevents downstream

out-of-bounds access from the same malformed metadata.

Compute the maximum valid lcns_follow from the al

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References