CVE-2026-64431

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ntfs: avoid calling post_write_mst_fixup() for invalid index_block<br /> <br /> ntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()<br /> returns an error, intending to restore the buffer after a failed write.<br /> <br /> However, ntfs_ib_write() returns an error immediately if<br /> pre_write_mst_fixup() validation fails. The caller,<br /> ntfs_icx_ib_sync_write(), interprets any error as a write failure<br /> requiring rollback. It does not differentiate between I/O errors and<br /> validation failures, and calls post_write_mst_fixup() anyway.<br /> <br /> Since post_write_mst_fixup() assumes that the index_block contents is<br /> correct, it doesn&amp;#39;t perform the boundary checks, which results in<br /> out-of-bounds memory access.<br /> <br /> An attacker can craft a malicious NTFS image with:<br /> - large index_block.usa_ofs offset, pointing outside the ntfs_record<br /> - index_block.usa_count = 0, causing integer underflow<br /> - or index_block.usa_count larger than actual number of sectors in the<br /> ntfs_record, causing out-of-bounds access<br /> <br /> KASAN reports describing the memory corruption:<br /> ==================================================================<br /> BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0<br /> Read of size 2 at addr ffff8881586c9018 by task p/9428<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x100/0x190<br /> print_report+0x139/0x4ad<br /> ? post_write_mst_fixup+0x19c/0x1d0<br /> ? __virt_addr_valid+0x262/0x500<br /> ? post_write_mst_fixup+0x19c/0x1d0<br /> kasan_report+0xe4/0x1d0<br /> ? post_write_mst_fixup+0x19c/0x1d0<br /> post_write_mst_fixup+0x19c/0x1d0<br /> ntfs_icx_ib_sync_write+0x179/0x220<br /> ntfs_inode_sync_filename+0x83d/0x1080<br /> __ntfs_write_inode+0x1049/0x1480<br /> ntfs_file_fsync+0x131/0x9b0<br /> ==================================================================<br /> BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x1aa/0x1d0<br /> Write of size 2 at addr ffff8881586c91fe by task p/9428<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x100/0x190<br /> print_report+0x139/0x4ad<br /> ? post_write_mst_fixup+0x1aa/0x1d0<br /> ? __virt_addr_valid+0x262/0x500<br /> ? post_write_mst_fixup+0x1aa/0x1d0<br /> kasan_report+0xe4/0x1d0<br /> ? post_write_mst_fixup+0x1aa/0x1d0<br /> post_write_mst_fixup+0x1aa/0x1d0<br /> ntfs_icx_ib_sync_write+0x179/0x220<br /> ntfs_inode_sync_filename+0x83d/0x1080<br /> __ntfs_write_inode+0x1049/0x1480<br /> ntfs_file_fsync+0x131/0x9b0<br /> ==================================================================<br /> <br /> Let&amp;#39;s move the post_write_mst_fixup() call to ntfs_ib_write().<br /> The ntfs_ib_write() function calls pre_write_mst_fixup() at the beginning.<br /> If the index_block contents is invalid, pre_write_mst_fixup() fails and<br /> ntfs_ib_write() returns early without calling post_write_mst_fixup() on<br /> bad index_block.