{"cve":"CVE-2026-64431","nvd":{"published":"2026-07-25T10:17:27.327","modified":"2026-09-03T18:29:10.100","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid calling post_write_mst_fixup() for invalid index_block\n\nntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()\nreturns an error, intending to restore the buffer after a failed write.\n\nHowever, ntfs_ib_write() returns an error immediately if\npre_write_mst_fixup() validation fails. The caller,\nntfs_icx_ib_sync_write(), interprets any error as a write failure\nrequiring rollback. It does not differentiate between I/O errors and\nvalidation failures, and calls post_write_mst_fixup() anyway.\n\nSince post_write_mst_fixup() assumes that the index_block contents is\ncorrect, it doesn't perform the boundary checks, which results in\nout-of-bounds memory access.\n\nAn attacker can craft a malicious NTFS image with:\n  - large index_block.usa_ofs offset, pointing outside the ntfs_record\n  - index_block.usa_count = 0, causing integer underflow\n  - or index_block.usa_count larger than actual number of sectors in the\n    ntfs_record, causing out-of-bounds access\n\nKASAN reports describing the memory corruption:\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0\n  Read of size 2 at addr ffff8881586c9018 by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x19c/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x19c/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x19c/0x1d0\n   post_write_mst_fixup+0x19c/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x1aa/0x1d0\n  Write of size 2 at addr ffff8881586c91fe by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   post_write_mst_fixup+0x1aa/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n\nLet's move the post_write_mst_fixup() call to ntfs_ib_write().\nThe ntfs_ib_write() function calls pre_write_mst_fixup() at the beginning.\nIf the index_block contents is invalid, pre_write_mst_fixup() fails and\nntfs_ib_write() returns early without calling post_write_mst_fixup() on\nbad index_block.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-787"],"references":["https://git.kernel.org/stable/c/5b6eedd7cc2936f9238e852b553a1b326105bde8","https://git.kernel.org/stable/c/e2018628301a6d9f54e34b0cb417f1688c66df1d"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:46:40.600842820+00:00"},"epss":{"cve":"CVE-2026-64431","score":0.00165,"percentile":0.05717,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}