CVE-2026-64432 Overview
CVE-2026-64432 is a slab out-of-bounds write vulnerability in the Linux kernel fs/ntfs3 driver. The flaw resides in the log_replay() function that processes NTFS $LogFile journal records during mount. A crafted NTFS image can trigger a heap out-of-bounds write in the Dirty Page Table (DPT) handling logic, corrupting kernel slab memory at mount time.
Critical Impact
A local attacker who can mount a malicious NTFS image can trigger kernel memory corruption, leading to denial of service or potential local privilege escalation.
Affected Products
- Linux kernel with the ntfs3 filesystem driver enabled
- Stable kernel branches referenced in the upstream fix commits
- Distributions shipping affected ntfs3 kernel modules
Discovery Timeline
- 2026-07-25 - CVE-2026-64432 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64432
Vulnerability Analysis
The vulnerability affects the analysis pass of the NTFS $LogFile journal replay routine. During replay, log_replay() copies Logical Cluster Numbers (LCNs) from each action log record into an existing Dirty Page Table entry. The routine writes into the destination page_lcns[] array without validating that the destination index remains within the allocated capacity.
KASAN reports a slab out-of-bounds write of 8 bytes at mount time when a crafted image is mounted. The write occurs inside log_replay+0x654c/0xdb60, corrupting adjacent slab objects controlled by the kernel allocator.
Root Cause
Two attacker-controlled fields drive the index j+i past the allocated page_lcns[] array. First, dp->lcns_follow, the DPT entry capacity, can be smaller than lrh->lcns_follow from the action record. Second, lrh->target_vcn may be smaller than dp->vcn, causing the unsigned 64-bit subtraction to wrap into a very large size_t value.
Neither field is bounds-checked before the copy loop executes. The fix validates the target VCN delta and per-record LCN count against the DPT entry capacity, then bails through the existing out: cleanup label with -EINVAL.
Attack Vector
Exploitation requires local access and the ability to trigger a mount of an attacker-supplied NTFS image. On systems where udev or automount services mount removable media automatically, physical insertion of a USB device carrying a crafted NTFS filesystem is sufficient. User interaction is required per the CVSS vector. The corruption occurs before user-space file operations begin.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in the upstream commit messages referenced under Kernel Git Commit c6f9e80 and related backports.
Detection Methods for CVE-2026-64432
Indicators of Compromise
- KASAN reports containing BUG: KASAN: slab-out-of-bounds in log_replay in kernel logs
- Unexpected kernel panics or oops entries traced to the ntfs3 module during mount operations
- Mount attempts of unknown or untrusted NTFS images originating from removable media or user-writable paths
Detection Strategies
- Monitor dmesg and /var/log/kern.log for ntfs3 errors, KASAN warnings, and slab corruption traces
- Audit mount syscalls specifying -t ntfs3 from non-administrative users or automount daemons
- Track loading of the ntfs3 kernel module on systems that do not require NTFS support
Monitoring Recommendations
- Collect kernel ring buffer telemetry to a central log platform for anomaly detection
- Alert on repeated mount failures involving ntfs3 from the same device or user
- Correlate USB device insertion events with subsequent filesystem mount attempts
How to Mitigate CVE-2026-64432
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds become available
- Disable automatic mounting of removable media on servers and privileged workstations until patched
- Restrict the ntfs3 module on systems that do not require NTFS support using modprobe blacklists
Patch Information
The fix has been merged into stable kernel branches. Refer to the following commits for the patch content and backport targets: Kernel Git Commit 3aa9695, Kernel Git Commit 57382ec, Kernel Git Commit 9460468, Kernel Git Commit 964c3fa, Kernel Git Commit c6f9e80, Kernel Git Commit cf28fc1, and Kernel Git Commit f433acc. The patch mirrors the bounds-check pattern introduced by commit b2bc7c44ed17 and commit 0ca0485e4b2e.
Workarounds
- Blacklist the ntfs3 module where NTFS support is not required
- Disable udisks or equivalent automount services for removable media on multi-user systems
- Enforce administrator-only mount policies via polkit rules or restrictive fstab entries
# Blacklist the ntfs3 module until a patched kernel is deployed
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u
# Verify the module is not loaded
lsmod | grep ntfs3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
