CVE-2026-64324

Analyzed Analyzed - Analysis Complete

Kernel Panic via UDF Free Block Extent Validation

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the guard while logicalBlockNum + offset + count points past the partition, which later indexes past the space bitmap array. A single ftruncate(2) on a file backed by such an extent reliably panics the kernel. This is a local availability issue. On desktop systems where UDisks/polkit allows the active user to mount removable UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply the crafted filesystem and trigger the panic by truncating a writable file on it. Systems that require root or CAP_SYS_ADMIN to mount the image have a higher prerequisite. No confidentiality or integrity impact is claimed: the reproduced primitive is an out-of-bounds read of a bitmap pointer slot followed by a kernel panic. Use the already computed logicalBlockNum + offset + count value for the partition length check. Also make load_block_bitmap() reject an out-of-range block group before indexing s_block_bitmap[], so corrupted callers cannot walk past the flexible array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64324

EUVD

EUVD-2026-48868

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.4.282 (inc) to 5.5 (exc)
linux	linux_kernel	From 4.19.320 (inc) to 4.20 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.10.224 (inc) to 5.10.261 (exc)
linux	linux_kernel	From 5.15.165 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 6.1.105 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.10.5 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.6.46 (inc) to 6.6.145 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the UDF filesystem driver. It involves improper validation of free block extents against partition length. A crafted extent can bypass checks, causing an out-of-bounds read in the space bitmap array. This leads to a kernel panic when a file is truncated, resulting in a local denial-of-service attack.

Detection Guidance

This vulnerability is specific to the Linux kernel's UDF filesystem handling. Detection requires checking the kernel version and UDF filesystem usage. Use 'uname -r' to check the kernel version and look for UDF-related modules with 'lsmod | grep udf'. Monitor system logs for kernel panics or crashes, especially after mounting UDF media.

Impact Analysis

On systems where unprivileged users can mount UDF media (e.g., via UDisks/polkit), an attacker can trigger a kernel panic by creating a malicious filesystem and truncating a file. This causes a system crash, disrupting availability. Systems requiring root or CAP_SYS_ADMIN for mounting are less affected.

Compliance Impact

This vulnerability is a local availability issue causing kernel panics via crafted UDF filesystems. It does not directly affect confidentiality or integrity of data, so it likely has minimal direct impact on compliance with standards like GDPR or HIPAA, which focus on data protection and availability.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the UDF filesystem vulnerability. If immediate patching is not possible, avoid mounting untrusted UDF media, especially on systems where unprivileged users can mount removable media. Restrict user permissions to prevent unauthorized mounting.

Hi! I’m here to help you understand CVE-2026-64324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70