CVE-2026-64432: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the analysis pass of $LogFile journal replay, log_replay() copies
LCNs from each action log record into an existing Dirty Page Table
(DPT) entry without bounding the destination index. A crafted NTFS
image with DPT entry lcns_follow=1 and an action log record with
lcns_follow=2 produces a kernel slab out-of-bounds write at mount
time:

  BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60
  Write of size 8 at addr ffff8880095e1040 by task mount

Two attacker-controlled fields can drive j+i past the allocated
page_lcns[] array:

  1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.
  2. lrh->target_vcn may be smaller than dp->vcn, making the u64
     subtraction wrap to a huge size_t.

Validate target VCN delta and per-record LCN count against the
DPT entry capacity, bail via the existing out: cleanup label with
-EINVAL.

This mirrors the bounds-check pattern added in commit b2bc7c44ed17
("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot")
and commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in
journal-replay file record check").

The Linux kernel CVE team has assigned CVE-2026-64432 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 5.15.212 with commit 964c3fae1dfc49dde5468eace940f199cda234e9
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.1.178 with commit 3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.6.145 with commit 946046841013ebac8492ef49651c53638d7a9a6a
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.12.96 with commit c6f9e804f73ef809529865fbc7256dd189ff8c33
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.18.39 with commit cf28fc1658463d768657cf1c27a83980d4ba7ef2
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 7.1.4 with commit f433acc85b86f327d03ba8b03a33c105c51053de
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 7.2-rc1 with commit 57382ec6ac63b63dce2789e835fded28b698ae79

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64432
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ntfs3/fslog.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9
	https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
	https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a
	https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33
	https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2
	https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de
	https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79