{"cvss":7.8,"datePublished":"2026-07-27T08:16:22.383","dateUpdated":"2026-11-03T18:15:39.353","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}\n\nIn do_action()'s UpdateRecordDataRoot (fslog.c:3489) and\nUpdateRecordDataAllocation (fslog.c:3697) cases, the memmove\ndestination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,\nwhere e->view.data_off comes from an on-disk NTFS_DE inside\nan INDEX_ROOT or INDEX_BUFFER.  Neither case validates\nview.data_off + dlen against e->size; the existing\ncheck_if_index_root / check_if_alloc_index helpers walk the\nentry chain and validate the entry's offset, but not its\ninternal view fields.\n\nThe neighbouring read sites (e.g., fs/ntfs3/index.c when\niterating view entries) check view.data_off + view.data_size\n<= e->size.  Apply the same bound at the two memmove sites.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 via\npr_warn-only probe instrumentation: with view.data_off forced\nto 0xFFFC, the memmove writes 32 bytes past the end of the\nNTFS_DE.\n\nThis is similar in shape to Pavitra Jha's 2026-05-02 patch\n\"fs/ntfs3: prevent oob in case UpdateRecordDataRoot\"\n(<20260502105008.21827-1-jhapavitra98@gmail.com>) which\nproposes calling ntfs3_bad_de_range(); that helper does not\nexist in mainline.  This patch uses inline checks.","id":"CVE-2026-64532","raw":{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b20e5a709d8bd190d6e4645606763c7423e694c1","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"d41b382068ca4e64e421f736cdd700095464b6ac","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"429d653ca641d38a78609b8f62e81a0a5c780a2d","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"315d3a9a48b49f889da3d858a9307e677cb9e1bd","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"be306b8d9143a9c076c804a7ca025d69caf9c448","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"36feda687afebae24c472202694448738809c411","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"3e127829e57f5190f612412ece4541cb96d5ec7a","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}\n\nIn do_action()'s UpdateRecordDataRoot (fslog.c:3489) and\nUpdateRecordDataAllocation (fslog.c:3697) cases, the memmove\ndestination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,\nwhere e->view.data_off comes from an on-disk NTFS_DE inside\nan INDEX_ROOT or INDEX_BUFFER.  Neither case validates\nview.data_off + dlen against e->size; the existing\ncheck_if_index_root / check_if_alloc_index helpers walk the\nentry chain and validate the entry's offset, but not its\ninternal view fields.\n\nThe neighbouring read sites (e.g., fs/ntfs3/index.c when\niterating view entries) check view.data_off + view.data_size\n<= e->size.  Apply the same bound at the two memmove sites.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 via\npr_warn-only probe instrumentation: with view.data_off forced\nto 0xFFFC, the memmove writes 32 bytes past the end of the\nNTFS_DE.\n\nThis is similar in shape to Pavitra Jha's 2026-05-02 patch\n\"fs/ntfs3: prevent oob in case UpdateRecordDataRoot\"\n(<20260502105008.21827-1-jhapavitra98@gmail.com>) which\nproposes calling ntfs3_bad_de_range(); that helper does not\nexist in mainline.  This patch uses inline checks."}],"id":"CVE-2026-64532","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:49.104430Z","version":"2.0.3"}}]},"published":"2026-07-27T08:16:22.383","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]},"severity":"HIGH","source":"nvd","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound NTFS_DE view.data_off in UpdateR..."}