CVE-2026-64533: fs/ntfs3: validate lcns_follow in log_replay conversion

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate lcns_follow in log_replay conversion

log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY
records when replaying version 0 restart tables.

During this conversion, the memmove() length is derived directly from
the on-disk lcns_follow field:

	memmove(&dp->vcn, &dp0->vcn_low,
		2 * sizeof(u64) +
				le32_to_cpu(dp->lcns_follow) * sizeof(u64));

check_rstbl() validates restart table structure, but does not constrain
per-entry lcns_follow values relative to the entry size. A malformed
filesystem image can provide an oversized lcns_follow value, causing
the conversion memmove() to access memory beyond the bounds of the
allocated restart table buffer.

The same field is later used to bound iteration over page_lcns[],
so validating lcns_follow during conversion also prevents downstream
out-of-bounds access from the same malformed metadata.

Compute the maximum valid lcns_follow from the already-validated
restart table entry size and reject entries that exceed this bound.
Reuse the existing t16/t32 scratch variables already declared in
log_replay() to avoid introducing new declarations.

[[email protected]: fixed the conflicts]

The Linux kernel CVE team has assigned CVE-2026-64533 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 5.15.212 with commit ca343a99806b4fc8e27c48f08be3445c5fcd1445
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.1.178 with commit ddfc8683e1a627dbf1b83bacf8961443dd654258
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.6.145 with commit 57c071e2c4f30b9c6f5aacb6679aab1269fbae99
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.12.97 with commit 159f694d682e4215b3822ae31ed3a4631628fe55
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 6.18.40 with commit 7adb38279812c9c06b0e3fa7382f4d7887f3fa2d
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 7.1.5 with commit 32b9f8733feb241627fa5f564b1a99b5cae974c5
	Issue introduced in 5.15 with commit b46acd6a6a627d876898e1c84d3f84902264b445 and fixed in 7.2-rc1 with commit 6a4c53a2e26a865565bd6a460961e8d6fcb32329

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64533
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ntfs3/fslog.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445
	https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258
	https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99
	https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55
	https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d
	https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5
	https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329