CVE-2026-64532: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and
UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove
destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,
where e->view.data_off comes from an on-disk NTFS_DE inside
an INDEX_ROOT or INDEX_BUFFER.  Neither case validates
view.data_off + dlen against e->size; the existing
check_if_index_root / check_if_alloc_index helpers walk the
entry chain and validate the entry's offset, but not its
internal view fields.

The neighbouring read sites (e.g., fs/ntfs3/index.c when
iterating view entries) check view.data_off + view.data_size
<= e->size.  Apply the same bound at the two memmove sites.

Reproduced under UML+KASAN on mainline 8d90b09e6741 via
pr_warn-only probe instrumentation: with view.data_off forced
to 0xFFFC, the memmove writes 32 bytes past the end of the
NTFS_DE.

This is similar in shape to Pavitra Jha's 2026-05-02 patch
"fs/ntfs3: prevent oob in case UpdateRecordDataRoot"
(<[email protected]>) which
proposes calling ntfs3_bad_de_range(); that helper does not
exist in mainline.  This patch uses inline checks.

The Linux kernel CVE team has assigned CVE-2026-64532 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 5.15.212 with commit b20e5a709d8bd190d6e4645606763c7423e694c1
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.1.178 with commit d41b382068ca4e64e421f736cdd700095464b6ac
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.6.145 with commit 429d653ca641d38a78609b8f62e81a0a5c780a2d
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.12.97 with commit 315d3a9a48b49f889da3d858a9307e677cb9e1bd
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.18.40 with commit be306b8d9143a9c076c804a7ca025d69caf9c448
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 7.1.5 with commit 36feda687afebae24c472202694448738809c411
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 7.2-rc1 with commit 3e127829e57f5190f612412ece4541cb96d5ec7a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64532
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ntfs3/fslog.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1
	https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac
	https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d
	https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd
	https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448
	https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411
	https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a