Executive brief
A vulnerability in the Linux kernel's handling of UDF file systems (commonly used on optical media like DVDs) could allow a specially crafted disk image to bypass security checks. By providing a disk with malformed metadata, an attacker could force the system to accept invalid data as legitimate. This could potentially lead to system instability or unauthorized access if a user mounts a malicious disk or image.
Technical details
A vulnerability exists in the udf_read_tagged() function within the Linux kernel's UDF file system implementation. The function skips CRC verification when the 'descCRCLength' plus the size of the tag exceeds the block size. An attacker can provide a crafted UDF image with an oversized descCRCLength value to bypass CRC validation entirely, causing the kernel to accept the descriptor based only on a trivially recomputable 8-bit checksum. This flaw can be exploited by mounting a malicious UDF image or physical media. Patches have been released across multiple stable kernel branches to reject descriptors where the CRC length exceeds the block size.
Affected products
- Linux Linux kernel 2.6.12-rc2 to 6.19
Timeline
- 2026-04-13: disclosed: Vulnerability reported by Michael Bommarito
- 2026-04-22: patched: Initial patch committed to master branch
- 2026-07-19: advisory: CVE-2026-53369 published
References
- https://git.kernel.org/stable/c/1873eb81c65d3f849418d7386baa39c439c9fc38
- https://git.kernel.org/stable/c/31605bbe94557bff721eaf041001169d44ac6f98
- https://git.kernel.org/stable/c/3dede76d525919bb966f9213e131af685de5ff99
- https://git.kernel.org/stable/c/50dfaf4a027742b4fcdc3e9305e7199ece9bc6a6
- https://git.kernel.org/stable/c/55d41b0a20128e86b9e960dd2e3f0a2d69a18df7
- https://git.kernel.org/stable/c/7d1b6adbf90df6c8941090d5646fbeca25ba9770
- https://git.kernel.org/stable/c/832ab4a882dc9b3c0155490d9993642ef545fd22