Executive brief
A vulnerability in the Linux kernel's UDF file system driver could allow a system crash or potential unauthorized code execution when a specially crafted disk image or physical media is mounted. The UDF format is commonly used for optical media like DVDs and some removable drives. An attacker would need to convince a user to mount a malicious image or have physical access to insert a compromised device into the system.
Technical details
A heap out-of-bounds write exists in the handle_partition_descriptor() function within fs/udf/super.c. The vulnerability is caused by improper bookkeeping where appended partition slots fail to record the 'partnum', leading to failed deduplication and continuous growth of 'num_part_descs'. When the table reaches capacity, the allocation logic incorrectly uses 'partnum' for sizing instead of the actual descriptor count; if 'partnum' is already aligned to the allocation step, the capacity is not increased, resulting in a write beyond the allocated buffer. This can be triggered by mounting a crafted UDF image. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the fixed commits in May 2026
Timeline
- 2026-03-10: disclosed: Initial patch submission by Seohyeon Maeng
- 2026-05-27: advisory: CVE-2026-45991 published by NVD
- 2026-05-17: patched: Fix committed to stable kernel trees