CVE-2026-53369

Awaiting Analysis Awaiting Analysis - Queue

UDF Descriptor CRC Length Validation Bypass

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-07

NVD

CVE-2026-53369

EUVD

EUVD-2026-45439

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 2.6.12.1 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the UDF file system. A crafted UDF image can set an oversized CRC length in a descriptor, causing the system to skip CRC verification. This bypasses data integrity checks, allowing the descriptor to be accepted based on a weak 8-bit tag checksum instead.

Detection Guidance

This vulnerability involves a flaw in the Linux kernel's UDF file system handling. Detection requires checking for UDF images with oversized CRC lengths. Use commands like 'fsck.udf' or 'udfinfo' on suspected UDF filesystems to verify CRC lengths. Monitor kernel logs for UDF-related errors or warnings after mounting UDF images.

Impact Analysis

An attacker could exploit this to bypass data integrity checks on UDF file systems, potentially leading to corrupted or malicious data being processed without detection. This could result in system instability, data loss, or unauthorized access if the system relies on UDF for critical operations.

Compliance Impact

This vulnerability could impact compliance by undermining data integrity requirements in GDPR and HIPAA. If UDF is used for storing sensitive data, bypassing CRC checks may violate integrity and security controls mandated by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. Avoid mounting untrusted UDF images until patched. If using UDF filesystems, verify CRC lengths manually before processing. Disable UDF support if not required.

Hi! I’m here to help you understand CVE-2026-53369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70