CVE-2026-64532: Linux Kernel NTFS3 Buffer Overflow Flaw

CVE-2026-64532 Overview

CVE-2026-64532 is an out-of-bounds write vulnerability in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in the do_action() function inside fslog.c, specifically in the UpdateRecordDataRoot and UpdateRecordDataAllocation cases. The driver fails to bound the NTFS_DE view data_off field before performing a memmove operation. A crafted NTFS INDEX_ROOT or INDEX_BUFFER structure can trigger the driver to write past the end of an NTFS_DE entry. Under UML with KASAN, a forced view.data_off value of 0xFFFC produced a 32-byte overflow past the entry boundary.

Critical Impact
Local attackers with the ability to mount or supply a malicious NTFS filesystem image can trigger kernel memory corruption, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel mainline containing the fs/ntfs3 driver (reproduced on commit 8d90b09e6741)
Stable kernel branches receiving fixes across seven backport commits
Distributions shipping ntfs3 with automount or user-mountable NTFS support enabled

Discovery Timeline

2026-07-27 - CVE-2026-64532 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64532

Vulnerability Analysis

The vulnerability sits in the ntfs3 log replay path. When do_action() processes UpdateRecordDataRoot at fslog.c:3489 and UpdateRecordDataAllocation at fslog.c:3697, it computes a memmove destination as Add2Ptr(e, le16_to_cpu(e->view.data_off)). The value e->view.data_off is read directly from an on-disk NTFS_DE structure embedded inside an INDEX_ROOT or INDEX_BUFFER. Neither code path validates that view.data_off + dlen falls within e->size before writing.

The existing check_if_index_root and check_if_alloc_index helpers walk the entry chain and validate each entry's outer offset, but they never inspect the internal view fields. Read sites in fs/ntfs3/index.c correctly enforce view.data_off + view.data_size <= e->size when iterating view entries. The write path in fslog.c diverges from this invariant, producing an asymmetric trust boundary between reads and writes.

Root Cause

The root cause is missing bounds validation of an attacker-controlled 16-bit field parsed from disk [CWE-787]. The data_off value is a little-endian offset consumed without comparison against the containing entry's size, so any value up to 0xFFFF is accepted and used as a pointer displacement for memmove.

Attack Vector

Exploitation requires local access and user interaction to mount or otherwise process a malicious NTFS volume. An attacker crafts an NTFS image containing an INDEX_ROOT or INDEX_BUFFER with an NTFS_DE whose view.data_off points beyond the entry. When the kernel replays the update log, the subsequent memmove writes attacker-influenced bytes into adjacent kernel heap memory. Reproduction under UML+KASAN with view.data_off set to 0xFFFC produced a 32-byte write past the NTFS_DE.

The vulnerability manifests in the update-record handling logic of fs/ntfs3/fslog.c. See the upstream commits linked under Patch Information for the exact bounds checks added at both memmove sites.

Detection Methods for CVE-2026-64532

Indicators of Compromise

Kernel oops or KASAN slab-out-of-bounds reports referencing do_action or UpdateRecordData frames in fs/ntfs3/fslog.c.
Unexpected NTFS mount attempts from removable media or user-namespace contexts on hosts that do not routinely process NTFS volumes.
Kernel panics or filesystem corruption events immediately following the mount of an externally supplied NTFS image.

Detection Strategies

Audit kernel logs for KASAN or slab corruption traces mentioning ntfs3 symbols, particularly around log replay.
Monitor mount and automount events for NTFS filesystems originating from USB devices, disk images, or loopback files.
Correlate filesystem driver crashes with process ancestry to identify unprivileged users triggering repeated mount attempts.

Monitoring Recommendations

Enable CONFIG_KASAN on test and staging kernels to surface out-of-bounds accesses during fuzzing of NTFS images.
Forward dmesg and journald kernel messages to a centralized logging pipeline and alert on ntfs3 warnings.
Track udev and systemd mount unit activity for NTFS volumes on servers where such mounts are not expected.

How to Mitigate CVE-2026-64532

Immediate Actions Required

Apply the upstream fs/ntfs3 patches to production kernels, or upgrade to a stable release incorporating the fixes.
Disable automatic mounting of NTFS volumes on multi-user systems and servers where the feature is not required.
Restrict physical and virtual access to USB, loopback, and removable-media mount paths for untrusted users.

Patch Information

The fix adds inline bounds checks equivalent to view.data_off + view.data_size <= e->size at the two memmove sites in do_action(). Backports are available across multiple stable branches. Reference commits: 315d3a9a48b4, 36feda687afe, 3e127829e57f, 429d653ca641, b20e5a709d8b, be306b8d9143, and d41b382068ca.

Workarounds

Blacklist the ntfs3 kernel module on systems that do not need NTFS read/write support.
Remove the SUID bit from user-space mount helpers and enforce mount restrictions through fstabnoauto and user=root options.
Use policy controls such as SELinux or AppArmor to prevent unprivileged processes from invoking NTFS mount syscalls.

bash

# Blacklist the ntfs3 module until patched kernels are deployed
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u