Out-of-bounds write in Linux kernel - CVE-2026-64532

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS index entry in UpdateRecordDataRoot or UpdateRecordDataAllocation. A local user can mount or otherwise supply a specially crafted NTFS image to trigger the out-of-bounds write and cause a denial of service.

The issue occurs because view.data_off and the resulting write length are not properly bounded against the NTFS_DE entry size.

Affected software

How to mitigate CVE-2026-64532

External References

• https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd
• https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411
• https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a
• https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d
• https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1
• https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448
• https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac

Related Security Bulletins

• Out-of-bounds write in Linux kernel ntfs3
• Debian update for linux