CVE-2026-53369
Received Received - Intake

UDF Descriptor CRC Length Validation Bypass

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-19
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-53369
EUVD
EUVD-2026-45439

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the UDF file system. A crafted UDF image can set an oversized CRC length in a descriptor, causing the system to skip CRC verification. This bypasses data integrity checks, allowing the descriptor to be accepted based on a weak 8-bit tag checksum instead.

Detection Guidance

This vulnerability involves a flaw in the Linux kernel's UDF file system handling. Detection requires checking for UDF images with oversized CRC lengths. Use commands like 'fsck.udf' or 'udfinfo' on suspected UDF filesystems to verify CRC lengths. Monitor kernel logs for UDF-related errors or warnings after mounting UDF images.

Impact Analysis

An attacker could exploit this to bypass data integrity checks on UDF file systems, potentially leading to corrupted or malicious data being processed without detection. This could result in system instability, data loss, or unauthorized access if the system relies on UDF for critical operations.

Compliance Impact

This vulnerability could impact compliance by undermining data integrity requirements in GDPR and HIPAA. If UDF is used for storing sensitive data, bypassing CRC checks may violate integrity and security controls mandated by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. Avoid mounting untrusted UDF images until patched. If using UDF filesystems, verify CRC lengths manually before processing. Disable UDF support if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart