CVE-2026-64533
fs/ntfs3: validate lcns_follow in log_replay conversion
Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [[email protected]: fixed the conflicts]
INFO
Published Date :
July 27, 2026, 8:16 a.m.
Last Modified :
July 27, 2026, 8:16 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64533
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to include the fix for NTFS3.
- Validate lcns_follow against entry size during conversion.
- Reject entries exceeding the maximum valid lcns_follow bound.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64533.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64533 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64533
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64533 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64533 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 27, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': 'ca343a99806b4fc8e27c48f08be3445c5fcd1445', 'versionType': 'git'}, {'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': 'ddfc8683e1a627dbf1b83bacf8961443dd654258', 'versionType': 'git'}, {'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': '57c071e2c4f30b9c6f5aacb6679aab1269fbae99', 'versionType': 'git'}, {'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': '159f694d682e4215b3822ae31ed3a4631628fe55', 'versionType': 'git'}, {'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': '7adb38279812c9c06b0e3fa7382f4d7887f3fa2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': '32b9f8733feb241627fa5f564b1a99b5cae974c5', 'versionType': 'git'}, {'status': 'affected', 'version': 'b46acd6a6a627d876898e1c84d3f84902264b445', 'lessThan': '6a4c53a2e26a865565bd6a460961e8d6fcb32329', 'versionType': 'git'}], 'programFiles': ['fs/ntfs3/fslog.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ntfs3/fslog.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [[email protected]: fixed the conflicts] Added Reference https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55 Added Reference https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5 Added Reference https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99 Added Reference https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329 Added Reference https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d Added Reference https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445 Added Reference https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258