CVE-2026-64532 fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
A missing bounds check in the Linux kernel NTFS3 driver allows out-of-bounds writes via crafted disk images, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-64532?
CVE-2026-64532 is a high-severity memory corruption vulnerability in Linux, published on 27 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e->size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields.
The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size <= e->size. Apply the same bound at the two memmove sites.
Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE.
This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" (<[email protected]>) which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks.
Weakness: CWE-787
Which versions are affected by CVE-2026-64532?
How do I fix CVE-2026-64532?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64532 being exploited?
There is no known exploitation of CVE-2026-64532 in the wild and no public exploit code.
Sources
Also known as AZL-93971, BELL-CVE-2026-64532, DEBIAN-CVE-2026-64532, GHSA-4mf8-7864-ff29, ROOT-OS-DEBIAN-12-CVE-2026-64532, UBUNTU-CVE-2026-64532.