CVE-2026-64324
Received Received - Intake

Kernel Panic via UDF Free Block Extent Validation

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the guard while logicalBlockNum + offset + count points past the partition, which later indexes past the space bitmap array. A single ftruncate(2) on a file backed by such an extent reliably panics the kernel. This is a local availability issue. On desktop systems where UDisks/polkit allows the active user to mount removable UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply the crafted filesystem and trigger the panic by truncating a writable file on it. Systems that require root or CAP_SYS_ADMIN to mount the image have a higher prerequisite. No confidentiality or integrity impact is claimed: the reproduced primitive is an out-of-bounds read of a bitmap pointer slot followed by a kernel panic. Use the already computed logicalBlockNum + offset + count value for the partition length check. Also make load_block_bitmap() reject an out-of-range block group before indexing s_block_bitmap[], so corrupted callers cannot walk past the flexible array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64324
EUVD
EUVD-2026-48868

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the UDF filesystem driver. It involves improper validation of free block extents against partition length. A crafted extent can bypass checks, causing an out-of-bounds read in the space bitmap array. This leads to a kernel panic when a file is truncated, resulting in a local denial-of-service attack.

Detection Guidance

This vulnerability is specific to the Linux kernel's UDF filesystem handling. Detection requires checking the kernel version and UDF filesystem usage. Use 'uname -r' to check the kernel version and look for UDF-related modules with 'lsmod | grep udf'. Monitor system logs for kernel panics or crashes, especially after mounting UDF media.

Impact Analysis

On systems where unprivileged users can mount UDF media (e.g., via UDisks/polkit), an attacker can trigger a kernel panic by creating a malicious filesystem and truncating a file. This causes a system crash, disrupting availability. Systems requiring root or CAP_SYS_ADMIN for mounting are less affected.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the UDF filesystem vulnerability. If immediate patching is not possible, avoid mounting untrusted UDF media, especially on systems where unprivileged users can mount removable media. Restrict user permissions to prevent unauthorized mounting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart