CVE-2026-64532

CVE-2026-64532 is a bounds-check bypass in the Linux NTFS3 driver's write paths. The vulnerability is notable not for its complexity but for what it reveals about validation discipline in the codebase: read operations in index.c already validate `view.data_off + view.data_size <= e->size` when iterating NTFS_DE (directory entry) structures, yet the equivalent write operations in fslog.c perform `view.data_off + dlen` without any bounds verification. This asymmetry means a crafted NTFS_DE entry with a manipulated `view.data_off` value can trigger an out-of-bounds kernel heap write during `UpdateRecordDataRoot` or `UpdateRecordDataAllocation`. The consequence is materially worse than a read-side bug—heap corruption can corrupt adjacent slab objects, potentially enabling privilege escalation rather than merely information disclosure. The most immediate action is to verify your kernel version and apply the patch. If you cannot patch immediately, the exposure is limited to systems mounting untrusted NTFS volumes—typically requires a malicious volume image rather than ordinary I/O, though this boundary warrants testing in your environment. Check whether your deployment mounts NTFS volumes from untrusted sources (removable media, network volumes from Windows systems, dual-boot scenarios). A prior incomplete fix attempt by Pavitra Jha (May 2026) proposed calling `ntfs3_bad_de_range()`, a helper that does not exist in mainline. The current patch uses inline checks instead. This raises a practical concern: audit fslog.c for other write paths that may have the same missing validation. The pattern of 'read paths validated, write paths trusted' has appeared in other filesystem modules—this CVE suggests NTFS3 may have similar latent gaps. Prioritize auditing any fslog.c functions that process on-disk NTFS structures without mirroring the bounds checks present in their index.c read counterparts.

Reviewed through automated stages and approved by a human before publication.