CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry()

In the Linux kernel, the following vulnerability has been resolved:

exfat: bound uniname advance in exfatfinddirentry()

In exfatfinddirentry(), each TYPEEXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length:

if (++order == 2) uniname = puniname->name; else uniname += EXFATFILENAMELEN; len = exfatextractuniname(ep, entryuniname); namelen += len; unichar = (uniname+len); (uniname+len) = 0x0;

uniname grows by EXFATFILENAMELEN (15) per name entry, but namelen grows only by the actual extracted length, which is shorter when a name fragment contains an early NUL. The only guard is namelen >= MAXNAMELENGTH, so a crafted directory with many short name fragments lets uniname run far past the puniname->name[MAXNAMELENGTH + 3] buffer while namelen stays small, causing an out-of-bounds read and write at (uniname+len).

The sibling extractor exfatgetuninamefromextentry() already stops on a short fragment (the lockstep len != EXFATFILENAMELEN guard added in commit d42334578eba ("exfat: check if filename entries exceeds max filename length")); exfatfinddirentry() never got the equivalent. Track the per-entry write offset as a count and reject a fragment once the offset, or the offset plus the extracted length, would exceed MAXNAMELENGTH, before forming the output pointer.