CVE-2026-64296: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64296 Overview

CVE-2026-64296 is an out-of-bounds read and write vulnerability in the Linux kernel's exFAT filesystem driver. The flaw resides in the exfat_find_dir_entry() function, where the output pointer uniname advances by a fixed EXFAT_FILE_NAME_LEN (15 bytes) per file name entry while the loop guard only tracks the accumulated extracted name length. A crafted directory containing many short name fragments with embedded early NUL bytes can drive the write pointer past the p_uniname->name[MAX_NAME_LENGTH + 3] buffer. This produces memory corruption within kernel address space.

Critical Impact
Local attackers who can mount or attach a malicious exFAT filesystem image can trigger kernel memory corruption, leading to code execution or system compromise.

Affected Products

Linux kernel exFAT filesystem driver (fs/exfat)
Multiple stable kernel branches referenced across eight upstream commits
Any Linux distribution that ships the affected exfat module and allows removable exFAT media

Discovery Timeline

2026-07-25 - CVE-2026-64296 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64296

Vulnerability Analysis

The vulnerability is a bounded-pointer arithmetic flaw in the exFAT long file name reconstruction path. When the kernel walks a directory entry set, each TYPE_EXTEND entry contributes up to 15 UTF-16 characters to the output name buffer. The loop increments uniname by a fixed EXFAT_FILE_NAME_LEN per entry, but name_len grows only by the count returned from exfat_extract_uni_name(), which is smaller whenever a fragment contains an early NUL terminator.

Because the loop termination check is name_len >= MAX_NAME_LENGTH, an attacker can supply many short fragments that keep name_len low while pushing uniname well beyond the destination buffer. The subsequent writes at *(uniname+len) = 0x0 and the preceding read at unichar = *(uniname+len) then touch out-of-bounds kernel memory.

Root Cause

The sibling function exfat_get_uniname_from_ext_entry() already contains a lockstep guard (len != EXFAT_FILE_NAME_LEN) added in commit d42334578eba, which rejects short fragments. The equivalent check was never added to exfat_find_dir_entry(). The write offset advances independently of the validated content length, breaking the buffer's implicit invariant.

Attack Vector

Exploitation is local and requires the victim system to process a crafted exFAT volume. Common triggers include inserting a malicious USB device, mounting a specially built disk image, or attaching an attacker-controlled loop device. A user with permission to mount removable media, or an unprivileged user on a system with automount enabled, can reach the vulnerable code path.

The vulnerability affects both reads and writes at the miscomputed pointer, giving an attacker primitives to corrupt adjacent kernel objects. Successful exploitation can yield privilege escalation from a local unprivileged account to kernel-mode execution.

No verified public proof-of-concept has been released. The upstream fix tracks the per-entry write offset as a count and rejects any fragment whose offset, or offset plus extracted length, would exceed MAX_NAME_LENGTH before forming the output pointer.

Detection Methods for CVE-2026-64296

Indicators of Compromise

Kernel oops or panic messages referencing exfat_find_dir_entry, exfat_extract_uni_name, or KASAN out-of-bounds reports in the exfat module
Unexpected mount operations of exFAT volumes from removable media or loop devices on servers that do not normally handle such filesystems
Presence of exFAT images with unusually long directory entry chains and many TYPE_EXTEND records containing embedded NUL bytes

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to catch the out-of-bounds access at runtime during triage
Audit dmesg and /var/log/kern.log for exfat warnings, slab corruption reports, or general protection faults following media insertion
Inventory kernel versions across the fleet using package management telemetry and correlate against the fixed commits listed on kernel.org

Monitoring Recommendations

Monitor mount and udev events for exFAT volumes attached to production servers, and alert on unexpected sources
Track kernel crash telemetry and core dumps that reference the exfat module
Log USB mass storage attach events at the endpoint level and correlate with subsequent kernel error messages

How to Mitigate CVE-2026-64296

Immediate Actions Required

Apply the upstream kernel patches referenced by the fix commits (for example 33c0b96d7e16, 3a1230e7b043, 727bf7783a29, 72a2589d82eb, c8e041c68c0b, ce4736c1e6c4, cf85180b8a01, fae76a94b35e) or upgrade to a distribution kernel that includes them
Restrict permissions to mount removable media to trusted administrators only
Disable automatic mounting of untrusted USB and removable exFAT devices on servers and shared workstations

Patch Information

The fix is available in the Linux stable tree. See the kernel.org commit 33c0b96d7e16 and the parallel backports at 3a1230e7b043, 727bf7783a29, 72a2589d82eb, c8e041c68c0b, ce4736c1e6c4, cf85180b8a01, and fae76a94b35e. The patch tracks the write offset as a counter and rejects fragments that would push the offset beyond MAX_NAME_LENGTH.

Workarounds

Unload the exfat kernel module on systems that do not require exFAT support: modprobe -r exfat and blacklist it in /etc/modprobe.d/
Enforce mount policies through udev rules or systemd to block automatic mounting of exFAT volumes from untrusted sources
Restrict physical and logical access to USB ports on high-value systems until patched kernels are deployed

bash

# Blacklist the exfat module until the kernel is patched
echo 'blacklist exfat' | sudo tee /etc/modprobe.d/blacklist-exfat.conf
sudo modprobe -r exfat

# Verify the module is not loaded
lsmod | grep exfat