CVE-2026-64431: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64431 Overview

CVE-2026-64431 is an out-of-bounds memory access vulnerability in the Linux kernel's NTFS filesystem implementation. The flaw resides in the ntfs_icx_ib_sync_write() function, which incorrectly invokes post_write_mst_fixup() even when pre_write_mst_fixup() validation has already failed. When an attacker mounts a crafted NTFS image, the kernel processes an invalid index_block without boundary checks, triggering slab-out-of-bounds reads and writes confirmed by KASAN reports.

Critical Impact
A local attacker able to mount a malicious NTFS image can trigger kernel memory corruption, leading to information disclosure, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel with the NTFS3 filesystem driver enabled
Distributions shipping vulnerable stable kernel versions prior to the fix commits 5b6eedd7cc29 and e2018628301a
Systems permitting mounting of untrusted NTFS filesystem images

Discovery Timeline

2026-07-25 - CVE-2026-64431 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64431

Vulnerability Analysis

The defect stems from error-handling logic in the NTFS3 write path. ntfs_icx_ib_sync_write() calls post_write_mst_fixup() whenever ntfs_ib_write() returns an error, treating every failure as a completed I/O that requires rollback. However, ntfs_ib_write() also returns errors when pre_write_mst_fixup() validation fails before any write occurs.

Because post_write_mst_fixup() assumes the index_block contents are structurally valid, it skips boundary checks on the update sequence array. Processing an unvalidated block against these assumptions produces out-of-bounds reads and writes in kernel slab memory, as observed in the published KASAN traces referencing ntfs_inode_sync_filename() and ntfs_file_fsync().

Root Cause

The root cause is a failure to differentiate validation errors from I/O errors in the write rollback path. The caller cannot distinguish whether the buffer was ever fixed up, so it unconditionally invokes the post-fixup routine. Combined with missing boundary checks in post_write_mst_fixup(), this permits arbitrary offsets encoded in index_block.usa_ofs and index_block.usa_count to drive memory access outside the intended ntfs_record.

Attack Vector

An attacker crafts a malicious NTFS image containing three specific manipulations: a usa_ofs value pointing outside the ntfs_record, a usa_count of zero that causes integer underflow, or a usa_count larger than the actual sector count in the record. When the kernel mounts the image and performs a synchronous write that fails pre-fixup validation, the post-fixup routine reads and writes past the slab allocation. Exploitation requires local access and the ability to mount attacker-controlled filesystem media.

See the upstream fix in Kernel Git Commit 5b6eedd and Kernel Git Commit e201862 for the code-level remediation.

Detection Methods for CVE-2026-64431

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0 or post_write_mst_fixup+0x1aa/0x1d0
Kernel call traces containing ntfs_icx_ib_sync_write, ntfs_inode_sync_filename, __ntfs_write_inode, or ntfs_file_fsync
Unexpected kernel oops or panic events immediately following NTFS mount or fsync operations on removable media

Detection Strategies

Audit mount syscalls for NTFS filesystem types originating from removable devices or user-writable loop devices
Enable KASAN on test kernels to surface the out-of-bounds access patterns during fuzzing of NTFS images
Correlate kernel ring buffer messages with process activity that reads or writes NTFS-hosted files

Monitoring Recommendations

Forward dmesg and /var/log/kern.log events to a centralized log store and alert on KASAN or oops signatures involving NTFS symbols
Track privileged mount operations and unusual filesystem driver crashes across the Linux fleet
Monitor for repeated crashes of processes performing fsync() against NTFS mounts, which may indicate exploitation attempts

How to Mitigate CVE-2026-64431

Immediate Actions Required

Apply stable kernel updates containing commits 5b6eedd7cc29 and e2018628301a as soon as vendor packages are available
Restrict the ability of unprivileged users to mount NTFS filesystems, particularly from removable media or loop devices
Disable automatic mounting of removable storage on servers and multi-user systems until patches are applied

Patch Information

The upstream fix relocates the post_write_mst_fixup() call into ntfs_ib_write() itself. Because ntfs_ib_write() invokes pre_write_mst_fixup() at the beginning and returns early on validation failure, post_write_mst_fixup() is no longer executed against an invalid index_block. Distribution maintainers are backporting the patch to supported stable branches; consult your vendor advisory for the specific package version.

Workarounds

Unload the ntfs3 kernel module on systems that do not require NTFS support using modprobe -r ntfs3
Add install ntfs3 /bin/true to /etc/modprobe.d/ to prevent the driver from loading at boot
Enforce udev or polkit rules that block non-root users from mounting untrusted NTFS media

bash

# Configuration example
# Disable the ntfs3 kernel module to eliminate the attack surface
echo "install ntfs3 /bin/true" | sudo tee /etc/modprobe.d/disable-ntfs3.conf
sudo modprobe -r ntfs3 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep ntfs3