CVE-2026-64533 (GCVE-0-2026-64533)

Vulnerability from cvelistv5 – Published: 2026-07-27 06:32 – Updated: 2026-08-17 04:57
VLAI
Title
fs/ntfs3: validate lcns_follow in log_replay conversion
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < ca343a99806b4fc8e27c48f08be3445c5fcd1445 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < ddfc8683e1a627dbf1b83bacf8961443dd654258 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 57c071e2c4f30b9c6f5aacb6679aab1269fbae99 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 159f694d682e4215b3822ae31ed3a4631628fe55 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 7adb38279812c9c06b0e3fa7382f4d7887f3fa2d (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 32b9f8733feb241627fa5f564b1a99b5cae974c5 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 6a4c53a2e26a865565bd6a460961e8d6fcb32329 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/fslog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca343a99806b4fc8e27c48f08be3445c5fcd1445",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "ddfc8683e1a627dbf1b83bacf8961443dd654258",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "57c071e2c4f30b9c6f5aacb6679aab1269fbae99",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "159f694d682e4215b3822ae31ed3a4631628fe55",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "7adb38279812c9c06b0e3fa7382f4d7887f3fa2d",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "32b9f8733feb241627fa5f564b1a99b5cae974c5",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "6a4c53a2e26a865565bd6a460961e8d6fcb32329",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/fslog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate lcns_follow in log_replay conversion\n\nlog_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY\nrecords when replaying version 0 restart tables.\n\nDuring this conversion, the memmove() length is derived directly from\nthe on-disk lcns_follow field:\n\n\tmemmove(\u0026dp-\u003evcn, \u0026dp0-\u003evcn_low,\n\t\t2 * sizeof(u64) +\n\t\t\t\tle32_to_cpu(dp-\u003elcns_follow) * sizeof(u64));\n\ncheck_rstbl() validates restart table structure, but does not constrain\nper-entry lcns_follow values relative to the entry size. A malformed\nfilesystem image can provide an oversized lcns_follow value, causing\nthe conversion memmove() to access memory beyond the bounds of the\nallocated restart table buffer.\n\nThe same field is later used to bound iteration over page_lcns[],\nso validating lcns_follow during conversion also prevents downstream\nout-of-bounds access from the same malformed metadata.\n\nCompute the maximum valid lcns_follow from the already-validated\nrestart table entry size and reject entries that exceed this bound.\nReuse the existing t16/t32 scratch variables already declared in\nlog_replay() to avoid introducing new declarations.\n\n[almaz.alexandrovich@paragon-software.com: fixed the conflicts]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The NTFS3 parser consumes malicious metadata from a locally mounted block device or filesystem image, not directly through a network protocol.\nAC:L - A structurally valid 44-byte entry with attacker-controlled lcns_follow=2 already crosses the heap-buffer boundary. No race or uncontrollable condition is required.\nPR:N - The attacker needs no account or capability to prepare and supply the crafted image; the init-namespace CAP_SYS_ADMIN mount requirement applies to the interacting victim or privileged mounting helper.\nUI:R - A victim or trusted mounting helper must cause the crafted NTFS filesystem to be mounted before journal replay processes the malicious metadata.\nS:U - The corruption compromises the kernel processing its own filesystem metadata and does not cross a distinct security authority such as a guest-to-host boundary.\nC:H - The attacker-controlled memmove performs a heap out-of-bounds read of attacker-selected extent, and the resulting memory corruption can be leveraged to disclose kernel memory.\nI:H - The same memmove writes beyond the allocated restart-table buffer, allowing corruption of adjacent slab objects and potentially arbitrary writes or control-flow hijacking.\nA:H - A sufficiently large lcns_follow reliably drives the kernel into an extensive invalid memory access, causing an oops or panic during mount and permitting repeated denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:11.184Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258"
        },
        {
          "url": "https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99"
        },
        {
          "url": "https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55"
        },
        {
          "url": "https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329"
        }
      ],
      "title": "fs/ntfs3: validate lcns_follow in log_replay conversion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64533",
    "datePublished": "2026-07-27T06:32:33.740Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-17T04:57:11.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64533",
      "date": "2026-09-21",
      "epss": "0.00135",
      "percentile": "0.0333"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/fslog.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ca343a99806b4fc8e27c48f08be3445c5fcd1445",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddfc8683e1a627dbf1b83bacf8961443dd654258",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57c071e2c4f30b9c6f5aacb6679aab1269fbae99",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "159f694d682e4215b3822ae31ed3a4631628fe55",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7adb38279812c9c06b0e3fa7382f4d7887f3fa2d",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32b9f8733feb241627fa5f564b1a99b5cae974c5",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a4c53a2e26a865565bd6a460961e8d6fcb32329",
                    "status": "affected",
                    "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/fslog.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate lcns_follow in log_replay conversion\n\nlog_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY\nrecords when replaying version 0 restart tables.\n\nDuring this conversion, the memmove() length is derived directly from\nthe on-disk lcns_follow field:\n\n\tmemmove(\u0026dp-\u003evcn, \u0026dp0-\u003evcn_low,\n\t\t2 * sizeof(u64) +\n\t\t\t\tle32_to_cpu(dp-\u003elcns_follow) * sizeof(u64));\n\ncheck_rstbl() validates restart table structure, but does not constrain\nper-entry lcns_follow values relative to the entry size. A malformed\nfilesystem image can provide an oversized lcns_follow value, causing\nthe conversion memmove() to access memory beyond the bounds of the\nallocated restart table buffer.\n\nThe same field is later used to bound iteration over page_lcns[],\nso validating lcns_follow during conversion also prevents downstream\nout-of-bounds access from the same malformed metadata.\n\nCompute the maximum valid lcns_follow from the already-validated\nrestart table entry size and reject entries that exceed this bound.\nReuse the existing t16/t32 scratch variables already declared in\nlog_replay() to avoid introducing new declarations.\n\n[almaz.alexandrovich@paragon-software.com: fixed the conflicts]"
          }
        ],
        "id": "CVE-2026-64533",
        "lastModified": "2026-08-17T05:17:58.350",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-27T08:16:22.510",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T06:27:37+00:00",
      "cve": "CVE-2026-64533",
      "id": "CVE-2026-64533",
      "initial_release_date": "2026-07-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: validate lcns_follow in log_replay conversion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64533.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:46:39Z",
      "cve": "CVE-2026-64533",
      "id": "CVE-2026-64533",
      "initial_release_date": "2026-07-27T17:00:02Z",
      "product_status:known_affected": "125",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64533",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64533.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.