CVE-2026-64532 - Vulnerability Details

- fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and
UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove
destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,
where e->view.data_off comes from an on-disk NTFS_DE inside
an INDEX_ROOT or INDEX_BUFFER. Neither case validates
view.data_off + dlen against e->size; the existing
check_if_index_root / check_if_alloc_index helpers walk the
entry chain and validate the entry's offset, but not its
internal view fields.

The neighbouring read sites (e.g., fs/ntfs3/index.c when
iterating view entries) check view.data_off + view.data_size
<= e->size. Apply the same bound at the two memmove sites.

Reproduced under UML+KASAN on mainline 8d90b09e6741 via
pr_warn-only probe instrumentation: with view.data_off forced
to 0xFFFC, the memmove writes 32 bytes past the end of the
NTFS_DE.

This is similar in shape to Pavitra Jha's 2026-05-02 patch
"fs/ntfs3: prevent oob in case UpdateRecordDataRoot"
(<20260502105008.21827-1-jhapavitra98@gmail.com>) which
proposes calling ntfs3_bad_de_range(); that helper does not
exist in mainline. This patch uses inline checks.

Published: 2026-07-27

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An unchecked memmove operation in the Linux kernel’s NTFS3 driver can write up to 32 bytes beyond the bounds of an NTFS_DE structure when updating a volume’s root or allocation indices. This out‑of‑bounds write corrupts kernel memory and is classified as CWE-120 and CWE-787. The corruption can be exploited to hijack kernel control flow or trigger a system crash.

Affected Systems

The flaw exists in any Linux kernel version that does not include the commit 8d90b09e6741, which added the missing bounds checks. All mainstream releases prior to that commit are affected. The available data does not list specific version numbers, so affected releases must be identified by checking the kernel version against the presence of that commit.

Risk and Exploitability

The CVSS base score of 7.8 indicates high severity, while the EPSS score of < 1% suggests a very low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that an attacker would need to introduce a corrupted NTFS volume, such as by mounting a malicious NTFS filesystem, to trigger the out‑of‑bounds write. This is a local attack vector that can lead to privilege escalation or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< b20e5a709d8bd190d6e4645606763c7423e694c1
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< d41b382068ca4e64e421f736cdd700095464b6ac
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 429d653ca641d38a78609b8f62e81a0a5c780a2d
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 315d3a9a48b49f889da3d858a9307e677cb9e1bd
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< be306b8d9143a9c076c804a7ca025d69caf9c448
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 36feda687afebae24c472202694448738809c411
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 3e127829e57f5190f612412ece4541cb96d5ec7a

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b46acd6a6a627d876898e1c84d3f84902264b445,b20e5a709d8bd190d6e4645606763c7423e694c1)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,d41b382068ca4e64e421f736cdd700095464b6ac)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,429d653ca641d38a78609b8f62e81a0a5c780a2d)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,315d3a9a48b49f889da3d858a9307e677cb9e1bd)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,be306b8d9143a9c076c804a7ca025d69caf9c448)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,36feda687afebae24c472202694448738809c411)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,3e127829e57f5190f612412ece4541cb96d5ec7a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[5.15.212,5.16.0)`	unaffected	generic	—
`[6.1.178,6.2.0)`	unaffected	generic	—
`[6.6.145,6.7.0)`	unaffected	generic	—
`[6.12.97,6.13.0)`	unaffected	generic	—
`[6.18.40,6.19.0)`	unaffected	generic	—
`[7.1.5,7.2.0)`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch commit 8d90b09e6741 or any later release that includes the fix.
If a patch cannot be applied immediately, disable or remove NTFS filesystem support to prevent mounting NTFS volumes.
Enable kernel address sanitizers such as KASAN or other memory protection mechanisms to detect and block out‑of‑bounds writes.

Generated by OpenCVE AI on October 20, 2026 at 09:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9003-1	Linux kernel (NVIDIA) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00133.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd
https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411
https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a
https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d
https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1
https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448
https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac
https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64532-3529@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64532
https://www.cve.org/CVERecord?id=CVE-2026-64532

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sat, 01 Aug 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122 CWE-20

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Thu, 30 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122 CWE-20

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64532-3529@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64532 https://www.cve.org/CVERecord?id=CVE-2026-64532
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e->size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size <= e->size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" (<20260502105008.21827-1-jhapavitra98@gmail.com>) which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks.
Title		fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411 https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1 https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448 https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T06:32:33.159Z

Updated: 2026-10-19T20:48:38.580Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64532

Vulnrichment

Updated: 2026-10-16T15:41:49.692Z

NVD

Status : Awaiting Analysis

Published: 2026-07-27T08:16:22.383

Modified: 2026-11-03T18:15:39.353

Link: CVE-2026-64532

Redhat

Severity : Moderate

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64532 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T10:00:14Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object