CVE-2026-64533 Linux CVE debrief

Who should care

Users of Linux kernel who use the ntfs3 filesystem, Linux kernel developers and maintainers, and security teams responsible for monitoring and patching Linux kernel vulnerabilities.

Technical summary

The vulnerability is in the log_replay() function which converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records. The memmove() length is derived directly from the on-disk lcns_follow field. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata.

Defensive priority

High

Recommended defensive actions

• Update Linux kernel to the latest version
• Use a trusted source for kernel updates
• Monitor system for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability has been resolved in the Linux kernel. The fix is available in the stable kernel tree. Evidence of the vulnerability's resolution can be found in the Linux kernel source code repository. Users should verify the presence of the fix in their specific kernel version. Additional verification steps include reviewing the commit history and checking for any related advisories from the Linux kernel community.

Official resources