The vulnerability in the Linux kernel NTFS3 driver (CVE-2026-64532) arises from missing validation of the view.data_off offset plus data length against the size of the NTFS directory entry (NTFS_DE) in the UpdateRecordDataRoot and UpdateRecordDataAllocation functions. These functions perform memmove operations to copy data, but without verifying that the destination buffer is within bounds, leading to out-of-bounds writes. Neighboring code paths perform such checks, but these two did not until this patch. The issue was reproduced with kernel address sanitizer (KASAN) showing a 32-byte overflow. The fix applies inline bounds checks to prevent this memory corruption.

Successful exploitation could lead to memory corruption, potentially allowing an attacker to compromise confidentiality, integrity, and availability of the system. The vulnerability requires local access with limited privileges and user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this vulnerability affects the Linux kernel NTFS3 driver, monitor for official kernel updates that include the fix. Until patched, avoid processing untrusted NTFS filesystem data to reduce risk.