Executive brief
A vulnerability exists in the Linux kernel's UDF file system driver, which is used to read optical discs like DVDs and Blu-rays. By providing a specially crafted or corrupted disk image, an attacker could cause the system to crash or potentially access sensitive information in the computer's memory. This issue primarily affects systems that automatically mount or process untrusted media files.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the Linux kernel UDF file system implementation within the lengthAllocDescs handling logic. When parsing an Allocation Extent Descriptor, the 'lengthAllocDescs' value is taken directly from on-disk data without sufficient validation against the block size. An attacker can provide a crafted UDF image where the total descriptor length exceeds the allocated buffer, causing udf_update_tag() to trigger a KASAN use-after-free read via crc_itu_t(). The fix involves validating the computed total length against the buffer head size (epos->bh->b_size) to ensure memory safety. Patch information is available in the stable kernel tree.
Affected products
- Linux Linux Kernel 2.6.12 through 6.12-rc4
Timeline
- 2025-09-22: disclosed: Vulnerability reported and fix proposed by Larshin Sergey.
- 2025-10-28: advisory: CVE-2025-40044 published.
- 2025-10-29: patched: Fix committed to stable kernel trees.
References
- https://git.kernel.org/stable/c/14496175b264d30c2045584ee31d062af2e3a660
- https://git.kernel.org/stable/c/1d1847812a1a5375c10a2a779338df643f79c047
- https://git.kernel.org/stable/c/3bd5e45c2ce30e239d596becd5db720f7eb83c99
- https://git.kernel.org/stable/c/459404f858213967ccfff336c41747d8dd186d38
- https://git.kernel.org/stable/c/918649364fbca7d5df72522ca795479edcd25f91
- https://git.kernel.org/stable/c/a70dcfa8d0a0cc530a6af59483dfca260b652c1b
- https://git.kernel.org/stable/c/b57f2d7d3e6bb89ed82330c5fe106cdfa34d3e24