CVE-2026-64533: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64533 Overview

CVE-2026-64533 is a Linux kernel vulnerability in the fs/ntfs3 filesystem driver. The flaw resides in log_replay(), which converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. The memmove() length is derived directly from the on-disk lcns_follow field without bounding it against the restart table entry size. A malformed NTFS filesystem image can supply an oversized lcns_follow value, triggering an out-of-bounds memory access on the allocated restart table buffer.

Critical Impact
A local attacker who can mount or induce mounting of a crafted NTFS image can trigger out-of-bounds memory access in kernel space, leading to memory corruption, information disclosure, or denial of service.

Affected Products

Linux kernel versions containing the fs/ntfs3 driver with the vulnerable log_replay() conversion path
Distributions shipping affected upstream kernels prior to the fix commits referenced by kernel.org
Systems that mount user-supplied NTFS images (removable media, disk images, containers)

Discovery Timeline

2026-07-27 - CVE-2026-64533 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64533

Vulnerability Analysis

The vulnerability sits in the NTFS journal replay path of the ntfs3 driver. During restart-table processing, log_replay() performs a structural conversion between two on-disk record layouts. The conversion issues a memmove() whose length is computed as 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64). Because lcns_follow is attacker-controlled metadata read from the filesystem image, it can be set to a value that exceeds the actual entry size. The subsequent memmove() then reads and writes past the bounds of the allocated restart table buffer. The same lcns_follow field is later used to bound iteration over page_lcns[], so the missing validation also enables downstream out-of-bounds access through the same crafted metadata.

Root Cause

check_rstbl() validates the overall restart table structure, but it does not constrain per-entry lcns_follow values relative to the entry size. This gap allows a malformed value to flow directly into a memmove() length calculation. The fix computes the maximum valid lcns_follow from the already-validated restart table entry size and rejects entries that exceed this bound, reusing the existing t16/t32 scratch variables in log_replay().

Attack Vector

Exploitation requires local access and user interaction, typically in the form of mounting a crafted NTFS filesystem image. An attacker supplies a filesystem image whose restart table entries contain an oversized lcns_follow field. When log_replay() processes the journal on mount, the unbounded memmove() corrupts adjacent kernel memory. Automounters, removable media handlers, and container or VM guest workflows that accept untrusted disk images expand the reachable attack surface. The vulnerability is described in the Linux kernel commit series published on kernel.org, including the primary fix commit and its stable backports.

Detection Methods for CVE-2026-64533

Indicators of Compromise

Kernel oops, BUG:, or KASAN reports referencing log_replay, ntfs3, or memmove in dmesg
Unexpected mount failures or kernel panics when mounting NTFS volumes from untrusted sources
Automount events for removable media or disk images from unattended users or services

Detection Strategies

Monitor kernel logs for KASAN out-of-bounds reports in fs/ntfs3/fslog.c
Audit mount syscall telemetry for ntfs3 filesystem type usage tied to non-administrative users or removable devices
Enable and review audit rules for filesystem image mounts originating from /media, /mnt, /run/media, or user home directories

Monitoring Recommendations

Alert on kernel crashes and panics correlated with NTFS mount operations
Track processes that invoke mount with untrusted image files or loopback devices
Baseline expected NTFS mount activity and flag deviations, particularly on servers where NTFS is not a normal filesystem

How to Mitigate CVE-2026-64533

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commit series once available through your distribution
Disable or blacklist the ntfs3 kernel module on systems that do not require NTFS support using echo "blacklist ntfs3" > /etc/modprobe.d/ntfs3.conf
Restrict mounting of removable media and disk images to administrative users only

Patch Information

The fix has been merged upstream and backported across stable trees. Relevant commits include 57c071e2c4f3, 159f694d682e, 32b9f8733feb, 6a4c53a2e26a, 7adb38279812, ca343a99806b, and ddfc8683e1a6. Update to a distribution kernel that incorporates these commits.

Workarounds

Prevent automounting of untrusted NTFS media by disabling desktop automount policies (gsettings set org.gnome.desktop.media-handling automount false)
Load the legacy ntfs read-only driver instead of ntfs3 where NTFS access is required but write support is not
Restrict user namespaces and CAP_SYS_ADMIN to reduce the population of accounts that can trigger arbitrary filesystem mounts

bash

# Configuration example: block ntfs3 module load until kernel is patched
echo "install ntfs3 /bin/false" | sudo tee /etc/modprobe.d/disable-ntfs3.conf
sudo update-initramfs -u
# Verify module is not loaded
lsmod | grep ntfs3