CVE-2026-64532

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}<br /> <br /> In do_action()&amp;#39;s UpdateRecordDataRoot (fslog.c:3489) and<br /> UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove<br /> destination is `Add2Ptr(e, le16_to_cpu(e-&gt;view.data_off))`,<br /> where e-&gt;view.data_off comes from an on-disk NTFS_DE inside<br /> an INDEX_ROOT or INDEX_BUFFER. Neither case validates<br /> view.data_off + dlen against e-&gt;size; the existing<br /> check_if_index_root / check_if_alloc_index helpers walk the<br /> entry chain and validate the entry&amp;#39;s offset, but not its<br /> internal view fields.<br /> <br /> The neighbouring read sites (e.g., fs/ntfs3/index.c when<br /> iterating view entries) check view.data_off + view.data_size<br /> size. Apply the same bound at the two memmove sites.<br /> <br /> Reproduced under UML+KASAN on mainline 8d90b09e6741 via<br /> pr_warn-only probe instrumentation: with view.data_off forced<br /> to 0xFFFC, the memmove writes 32 bytes past the end of the<br /> NTFS_DE.<br /> <br /> This is similar in shape to Pavitra Jha&amp;#39;s 2026-05-02 patch<br /> "fs/ntfs3: prevent oob in case UpdateRecordDataRoot"<br /> () which<br /> proposes calling ntfs3_bad_de_range(); that helper does not<br /> exist in mainline. This patch uses inline checks.