CVE-2026-89525

Received Received - Intake

Out-of-Bounds Read in Linux Kernel UDF Filesystem

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89525

EUVD

EUVD-2026-76431

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect bounds checking in the UDF file system. The function udf_get_pblock_virt15() rejects only VAT indexes greater than s_num_entries but allows indexes equal to s_num_entries. This lets an attacker read one entry past the allocated VAT table, causing a slab-out-of-bounds read.

Detection Guidance

This vulnerability is specific to the Linux kernel's UDF filesystem handling. Detection requires checking the kernel version and UDF filesystem usage. Inspect running kernel version with 'uname -a' and check for UDF mounts with 'mount | grep udf'. If UDF is used, monitor for slab-out-of-bounds errors in kernel logs using 'dmesg | grep -i udf' or 'journalctl -k | grep -i udf'.

Impact Analysis

This flaw could allow an attacker with access to a crafted UDF image to trigger a kernel panic or read sensitive memory, potentially leading to system instability or unauthorized data access. It may also enable privilege escalation if combined with other exploits.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel memory safety issue in the UDF filesystem driver that could lead to kernel memory corruption or crashes. Compliance impacts would only occur if exploitation resulted in unauthorized data access or system compromise, which is not specified in the provided context.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version. Avoid mounting UDF filesystems from untrusted sources. If UDF usage is necessary, restrict access to trusted images only. Monitor kernel logs for any signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-89525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70