CVE-2026-64432 is a vulnerability in the Linux kernel's NTFS3 filesystem driver where the log_replay() function copies Logical Cluster Numbers (LCNs) into a Dirty Page Table (DPT) entry without properly bounding the destination index. Specifically, the vulnerability arises when a crafted NTFS image has a DPT entry with lcns_follow=1 and an action log record with lcns_follow=2, causing an out-of-bounds write in kernel memory during mount time. Two attacker-controlled fields, dp->lcns_follow and lrh->target_vcn, can cause the index to exceed the allocated array size, leading to a slab out-of-bounds write detected by KASAN. The fix involves validating the target VCN delta and per-record LCN count against the DPT entry capacity and aborting with an error if invalid. This vulnerability has a CVSS 3.1 score of 7.8 (high severity) and affects multiple Linux kernel versions prior to 7.0.0-31.31 and related builds. Ubuntu has released patches in their 7.0 kernel series for various hardware enablement and OEM kernels.

Successful exploitation can cause a kernel slab out-of-bounds write, potentially leading to system crashes, memory corruption, or privilege escalation. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. The vulnerability is local with low attack complexity and requires user interaction but no privileges. There are no known exploits in the wild at this time.

A patch is available from Ubuntu and other Linux kernel maintainers. Users should update to the fixed kernel versions as listed in the Ubuntu advisories (e.g., linux-image-7.0.0-31.31 and later). After updating, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. No additional mitigations are specified beyond applying the official kernel updates.