CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid calling postwritemstfixup() for invalid indexblock

ntfsicxibsyncwrite() calls postwritemstfixup() when ntfsib_write() returns an error, intending to restore the buffer after a failed write.

However, ntfsibwrite() returns an error immediately if prewritemstfixup() validation fails. The caller, ntfsicxibsyncwrite(), interprets any error as a write failure requiring rollback. It does not differentiate between I/O errors and validation failures, and calls postwritemstfixup() anyway.

Since postwritemstfixup() assumes that the indexblock contents is correct, it doesn't perform the boundary checks, which results in out-of-bounds memory access.

An attacker can craft a malicious NTFS image with: - large indexblock.usaofs offset, pointing outside the ntfsrecord - indexblock.usacount = 0, causing integer underflow - or indexblock.usacount larger than actual number of sectors in the ntfsrecord, causing out-of-bounds access

KASAN reports describing the memory corruption: ================================================================== BUG: KASAN: slab-out-of-bounds in postwritemstfixup+0x19c/0x1d0 Read of size 2 at addr ffff8881586c9018 by task p/9428 Call Trace: <TASK> dumpstacklvl+0x100/0x190 printreport+0x139/0x4ad ? postwritemst_fixup+0x19c/0x1d0 ? __virtaddrvalid+0x262/0x500 ? postwritemstfixup+0x19c/0x1d0 kasanreport+0xe4/0x1d0 ? postwritemstfixup+0x19c/0x1d0 postwritemstfixup+0x19c/0x1d0 ntfsicxibsyncwrite+0x179/0x220 ntfsinodesync_filename+0x83d/0x1080 __ntfswriteinode+0x1049/0x1480 ntfsfilefsync+0x131/0x9b0 ================================================================== BUG: KASAN: slab-out-of-bounds in postwritemstfixup+0x1aa/0x1d0 Write of size 2 at addr ffff8881586c91fe by task p/9428 Call Trace: <TASK> dumpstacklvl+0x100/0x190 printreport+0x139/0x4ad ? postwritemst_fixup+0x1aa/0x1d0 ? __virtaddrvalid+0x262/0x500 ? postwritemstfixup+0x1aa/0x1d0 kasanreport+0xe4/0x1d0 ? postwritemstfixup+0x1aa/0x1d0 postwritemstfixup+0x1aa/0x1d0 ntfsicxibsyncwrite+0x179/0x220 ntfsinodesync_filename+0x83d/0x1080 __ntfswriteinode+0x1049/0x1480 ntfsfilefsync+0x131/0x9b0 ==================================================================

Let's move the postwritemstfixup() call to ntfsibwrite(). The ntfsibwrite() function calls prewritemstfixup() at the beginning. If the indexblock contents is invalid, prewritemstfixup() fails and ntfsibwrite() returns early without calling postwritemstfixup() on bad indexblock.