CVE-2026-64432High· 7.8▾ Twilight

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass of $LogFile journal replay, log_replay() copies LCNs from each action log rec…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 25, 2026

Updated

Oct 19, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.14% · p3

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 86 days

Jul 25, 2026Published
Disclosed via CVEORG
Oct 16, 2026EPSS first tracked
0.1%
Oct 19, 2026Record revised
Last analysed / modified upstream

Linux #cve.org

Affected

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 964c3fae1dfc49dde5468eace940f199cda234e9
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 946046841013ebac8492ef49651c53638d7a9a6a
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < c6f9e804f73ef809529865fbc7256dd189ff8c33
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < cf28fc1658463d768657cf1c27a83980d4ba7ef2
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < f433acc85b86f327d03ba8b03a33c105c51053de
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 57382ec6ac63b63dce2789e835fded28b698ae79
Linux 5.15

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the analysis pass of $LogFile journal replay, log_replay() copies LCNs from each action log record into an existing Dirty Page Table (DPT) entry without bounding the destination index. A crafted NTFS image with DPT entry lcns_follow=1 and an action log record with lcns_follow=2 produces a kernel slab out-of-bounds write at mount time:

BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60 Write of size 8 at addr ffff8880095e1040 by task mount

Two attacker-controlled fields can drive j+i past the allocated page_lcns[] array:

dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.
lrh->target_vcn may be smaller than dp->vcn, making the u64 subtraction wrap to a huge size_t.

Validate target VCN delta and per-record LCN count against the DPT entry capacity, bail via the existing out: cleanup label with -EINVAL.

This mirrors the bounds-check pattern added in commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot") and commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in journal-replay file record check").

Affected

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 964c3fae1dfc49dde5468eace940f199cda234e9
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 946046841013ebac8492ef49651c53638d7a9a6a
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < c6f9e804f73ef809529865fbc7256dd189ff8c33
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < cf28fc1658463d768657cf1c27a83980d4ba7ef2
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < f433acc85b86f327d03ba8b03a33c105c51053de
Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 57382ec6ac63b63dce2789e835fded28b698ae79
Linux 5.15

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60 Write of size 8 at addr ffff8880095e1040 by task mount

Two attacker-controlled fields can drive j+i past the allocated page_lcns[] array:

dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.

lrh->target_vcn may be smaller than dp->vcn, making the u64 subtraction wrap to a huge size_t.

Validate target VCN delta and per-record LCN count against the DPT entry capacity, bail via the existing out: cleanup label with -EINVAL.

Affected

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 964c3fae1dfc49dde5468eace940f199cda234e9

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 3aa96956ca2200674e2a8f9c23ec6ecd45e5010f

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 946046841013ebac8492ef49651c53638d7a9a6a

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < c6f9e804f73ef809529865fbc7256dd189ff8c33

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < cf28fc1658463d768657cf1c27a83980d4ba7ef2

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < f433acc85b86f327d03ba8b03a33c105c51053de

Linux >= b46acd6a6a627d876898e1c84d3f84902264b445 < 57382ec6ac63b63dce2789e835fded28b698ae79

Linux 5.15