Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver could allow a system crash or memory corruption when mounting a specially crafted storage device. The issue occurs during the processing of the NTFS journal file, which is used to recover the file system after an improper shutdown. An attacker could exploit this by providing a malicious NTFS-formatted drive or disk image, potentially leading to a denial of service or unauthorized system modifications.
Technical details
A slab out-of-bounds write exists in the fs/ntfs3/fslog.c:log_replay() function of the Linux kernel. During the analysis pass of $LogFile journal replay, the code copies Logical Cluster Numbers (LCNs) into the Dirty Page Table (DPT) without verifying that the destination index is within the allocated bounds of the page_lcns[] array. An attacker can trigger this by crafting an NTFS image where the DPT capacity is smaller than the log record's LCN count, or by manipulating the target Virtual Cluster Number (VCN) to cause an unsigned integer wrap-around during index calculation. This results in a kernel panic or memory corruption at mount time. The issue has been patched by adding explicit bounds checks against the DPT capacity.
Affected products
- Linux Linux Kernel b46acd6a6a62 to 57382ec6ac63
Timeline
- 2026-05-04: other: Vulnerability reported by researchers
- 2026-06-02: patched: Initial fix committed to mainline kernel
- 2026-07-25: advisory: CVE-2026-64432 published
References
- https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
- https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79
- https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a
- https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9
- https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33
- https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2
- https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de