CVE-2026-64323

Awaiting Analysis Awaiting Analysis - Queue

UDF Filesystem Out-of-Bounds Read via VAT Header

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64323

EUVD

EUVD-2026-49035

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's UDF file system implementation. It involves a lack of validation of the VAT header length in a virtual partition, allowing an attacker to specify an excessively large offset. This causes an integer underflow when calculating the number of entries, leading to an out-of-bounds read when accessing inode data.

Detection Guidance

This vulnerability affects the Linux kernel's UDF file system module. Detection requires checking for vulnerable kernel versions and inspecting UDF file system mounts. Use 'uname -a' to check kernel version and 'lsmod | grep udf' to verify if the UDF module is loaded. Inspect mounted UDF file systems with 'mount | grep udf'.

Impact Analysis

An attacker could exploit this to read sensitive kernel memory by mounting a specially crafted UDF image. This could lead to information disclosure or potential privilege escalation if combined with other vulnerabilities. Systems using vulnerable Linux kernel versions with UDF support are at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling out-of-bounds read attacks on systems processing sensitive data. If exploited, it may lead to unauthorized data access or disclosure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix. If immediate patching is not possible, unload the UDF module using 'rmmod udf' or prevent it from loading by blacklisting it in '/etc/modprobe.d/'. Avoid mounting untrusted UDF images until patched.

Hi! I’m here to help you understand CVE-2026-64323. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70