Out-of-bounds write in Linux kernel - CVE-2026-64432
Published: July 27, 2026
Vulnerability identifier: #VU139511
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64432
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in log_replay in fs/ntfs3/fslog.c when mounting a crafted NTFS image and replaying the $LogFile journal. A local user can provide a specially crafted NTFS image to cause a denial of service or execute arbitrary code.
The issue can be triggered at mount time during the analysis pass when LCNs from an action log record are copied into an existing Dirty Page Table entry, and integer underflow in the target VCN delta can drive the destination index past the allocated page_lcns array.
Affected software
Linux kernel
How to mitigate CVE-2026-64432
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
- https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79
- https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a
- https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9
- https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33
- https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2
- https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de