CVE-2026-64296 - Vulnerability Details

- exfat: bound uniname advance in exfat_find_dir_entry()

Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: bound uniname advance in exfat_find_dir_entry()

In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the
output pointer by a fixed amount while the loop guard only tracks the
accumulated name length:

if (++order == 2)
uniname = p_uniname->name;
else
uniname += EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
name_len += len;
unichar = *(uniname+len);
*(uniname+len) = 0x0;

uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len
grows only by the actual extracted length, which is shorter when a name
fragment contains an early NUL. The only guard is
`name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short
name fragments lets uniname run far past the
p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,
causing an out-of-bounds read and write at *(uniname+len).

The sibling extractor exfat_get_uniname_from_ext_entry() already stops
on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard
added in commit d42334578eba ("exfat: check if filename entries exceeds
max filename length")); exfat_find_dir_entry() never got the
equivalent. Track the per-entry write offset as a count and reject a
fragment once the offset, or the offset plus the extracted length, would
exceed MAX_NAME_LENGTH, before forming the output pointer.

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is in exfat_find_dir_entry(): the routine moves a pointer forward by a fixed size for each file name fragment while only tracking the cumulative name length. When a directory contains many short fragments, the pointer can exceed the bounds of the allocated buffer while the length counter stays within limits, which triggers an out-of-bounds read and subsequent write. This kernel-space overflow is classified as an out-of-bounds read/write (CWE-125) and an out-of-bounds write (CWE-787).

Affected Systems

All Linux kernels that compile exFAT support are affected. The vulnerability exists in kernel implementations of the exFAT file system that have not yet applied the commit that fixes exfat_find_dir_entry().

Risk and Exploitability

The EPSS score is < 1%, indicating a very low current likelihood of exploitation. The vulnerability is absent from the CISA KEV catalog and has a CVSS score of 7.8, indicating high severity if executed. Based on the description, it is inferred that an attacker would need to supply a crafted exFAT filesystem—typically via a removable storage device—to trigger the overflow when mounted by a privileged process.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 72a2589d82eb001c94b74bcfe6f9a599bd9bef60
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< cf85180b8a015029ee147694eaf4e0b3537e9432
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 727bf7783a2936ffd55c628dddfd69343e511dcf
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 33c0b96d7e1672be1de0053786637ea46fb81507
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< c8e041c68c0bbb73aa62371ee63947bb6949d8b2
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 3a1230e7b043c62737b05a3e9275ca83a43ad20a

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,72a2589d82eb001c94b74bcfe6f9a599bd9bef60)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,cf85180b8a015029ee147694eaf4e0b3537e9432)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,727bf7783a2936ffd55c628dddfd69343e511dcf)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,33c0b96d7e1672be1de0053786637ea46fb81507)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,c8e041c68c0bbb73aa62371ee63947bb6949d8b2)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,3a1230e7b043c62737b05a3e9275ca83a43ad20a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit referenced in the advisory that corrects exfat_find_dir_entry().
If a kernel update cannot be applied immediately, disable exFAT support or refrain from mounting untrusted exFAT partitions to eliminate the attack surface.
Continuously monitor system logs and kernel crash dumps for signs of memory corruption or unexpected panics that may indicate exploitation attempts.

Generated by OpenCVE AI on October 20, 2026 at 09:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00169.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/33c0b96d7e1672be1de0053786637ea46fb81507
https://git.kernel.org/stable/c/3a1230e7b043c62737b05a3e9275ca83a43ad20a
https://git.kernel.org/stable/c/727bf7783a2936ffd55c628dddfd69343e511dcf
https://git.kernel.org/stable/c/72a2589d82eb001c94b74bcfe6f9a599bd9bef60
https://git.kernel.org/stable/c/c8e041c68c0bbb73aa62371ee63947bb6949d8b2
https://git.kernel.org/stable/c/ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0
https://git.kernel.org/stable/c/cf85180b8a015029ee147694eaf4e0b3537e9432
https://git.kernel.org/stable/c/fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4
https://lore.kernel.org/linux-cve-announce/2026072505-CVE-2026-64296-f344@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64296
https://www.cve.org/CVERecord?id=CVE-2026-64296

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 12 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026072505-CVE-2026-64296-f344@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64296 https://www.cve.org/CVERecord?id=CVE-2026-64296
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if (++order == 2) uniname = p_uniname->name; else uniname += EXFAT_FILE_NAME_LEN; len = exfat_extract_uni_name(ep, entry_uniname); name_len += len; unichar = (uniname+len); (uniname+len) = 0x0; uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len grows only by the actual extracted length, which is shorter when a name fragment contains an early NUL. The only guard is `name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short name fragments lets uniname run far past the p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small, causing an out-of-bounds read and write at *(uniname+len). The sibling extractor exfat_get_uniname_from_ext_entry() already stops on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard added in commit d42334578eba ("exfat: check if filename entries exceeds max filename length")); exfat_find_dir_entry() never got the equivalent. Track the per-entry write offset as a count and reject a fragment once the offset, or the offset plus the extracted length, would exceed MAX_NAME_LENGTH, before forming the output pointer.
Title		exfat: bound uniname advance in exfat_find_dir_entry()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/33c0b96d7e1672be1de0053786637ea46fb81507 https://git.kernel.org/stable/c/3a1230e7b043c62737b05a3e9275ca83a43ad20a https://git.kernel.org/stable/c/727bf7783a2936ffd55c628dddfd69343e511dcf https://git.kernel.org/stable/c/72a2589d82eb001c94b74bcfe6f9a599bd9bef60 https://git.kernel.org/stable/c/c8e041c68c0bbb73aa62371ee63947bb6949d8b2 https://git.kernel.org/stable/c/ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0 https://git.kernel.org/stable/c/cf85180b8a015029ee147694eaf4e0b3537e9432 https://git.kernel.org/stable/c/fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:33.847Z

Updated: 2026-10-19T20:38:22.402Z

Reserved: 2026-07-19T15:36:31.778Z

Link: CVE-2026-64296

Vulnrichment

Updated: 2026-10-16T15:38:35.299Z

NVD

Status : Modified

Published: 2026-07-25T10:17:10.390

Modified: 2026-10-19T21:17:30.130

Link: CVE-2026-64296

Redhat

Severity : Important

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64296 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T09:30:12Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-787
Out-of-bounds Write
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object