Homepage

CVE-2026-64533 Affecting linux-6.12 package, versions <6.12.100-1~deb12u1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.14% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-LINUX612-18579342
  • published7 Aug 2026
  • disclosed27 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 27 Jul 2026

CVE-2026-64533  (opens in a new tab)

How to fix?

Upgrade Echo:latest linux-6.12 to version 6.12.100-1~deb12u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate lcns_follow in log_replay conversion

log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables.

During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field:

memmove(&amp;dp-&gt;vcn, &amp;dp0-&gt;vcn_low,
    2 * sizeof(u64) +
            le32_to_cpu(dp-&gt;lcns_follow) * sizeof(u64));

check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer.

The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata.

Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations.

[almaz.alexandrovich@paragon-software.com: fixed the conflicts]