CVE-2026-64533

In the Linux kernel NTFS3 code, the log_replay path that converts DIR_PAGE_ENTRY_32 to DIR_PAGE_ENTRY may read beyond bounds when processing lcns_follow, enabling out-of-bounds access from malformed restart-table metadata. The fix constrains memmove length by computing the maximum valid lcns_foll...

EUVD-2026-49111

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fro...