Homepage

Out-of-bounds Write Affecting perf6.12 package, versions <1:6.12.100-125.179.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.14% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-PERF612-18912095
  • published18 Aug 2026
  • disclosed27 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 27 Jul 2026

NewCVE-2026-64533  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 perf6.12 to version 1:6.12.100-125.179.amzn2023 or higher.
This issue was patched in ALAS2023-2026-2057.

NVD Description

Note: Versions mentioned in the description apply only to the upstream perf6.12 package and not the perf6.12 package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate lcns_follow in log_replay conversion

log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables.

During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field:

memmove(&amp;dp-&gt;vcn, &amp;dp0-&gt;vcn_low,
    2 * sizeof(u64) +
            le32_to_cpu(dp-&gt;lcns_follow) * sizeof(u64));

check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer.

The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata.

Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations.

[almaz.alexandrovich@paragon-software.com: fixed the conflicts]