CVE-2026-64533

CVE CVE-2026-64533EUVD EUVD-2026-49111Published 2026-07-27T06:32:33.000ZLast changed 2026-08-05T12:42:43.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp->lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts]

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux b46acd6a6a627d876898e1c84d3f84902264b445 <159f694d682e4215b3822ae31ed3a4631628fe55; patch: 6.1.178; b46acd6a6a627d876898e1c84d3f84902264b445 <57c071e2c4f30b9c6f5aacb6679aab1269fbae99; b46acd6a6a627d876898e1c84d3f84902264b445 <7adb38279812c9c06b0e3fa7382f4d7887f3fa2d; patch: 7.1.5; patch: 6.6.145; b46acd6a6a627d876898e1c84d3f84902264b445 <ddfc8683e1a627dbf1b83bacf8961443dd654258; b46acd6a6a627d876898e1c84d3f84902264b445 <32b9f8733feb241627fa5f564b1a99b5cae974c5; patch: 6.12.97; patch: 5.15.212; patch: 0; b46acd6a6a627d876898e1c84d3f84902264b445 <6a4c53a2e26a865565bd6a460961e8d6fcb32329; 5.15; patch: 7.2-rc1; b46acd6a6a627d876898e1c84d3f84902264b445 <ca343a99806b4fc8e27c48f08be3445c5fcd1445; patch: 6.18.40

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.