Junglewise Threat Intelligence

CVE-2026-64323: Linux Kernel out-of-bounds read in UDF udf_load_vat

CVE-2026-64323 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's UDF file system driver could allow a system crash or information disclosure when a specially crafted disk image or physical media is mounted. The issue stems from a failure to properly check the size of certain data structures on the disk, which can lead to the system reading memory outside of intended boundaries. This could be used by an attacker with physical access or the ability to mount disk images to compromise the stability of the system.

Technical details

An out-of-bounds read vulnerability exists in the udf_load_vat() function within the Linux kernel's UDF file system implementation. The vulnerability is caused by a lack of validation for the 'lengthHeader' value in the on-disk VAT 2.0 header against the VAT inode size. An attacker can provide a large 16-bit lengthHeader value that causes an integer underflow when calculating 's_num_entries'. This underflow bypasses subsequent bounds checks in udf_get_pblock_virt15(), leading to an out-of-bounds read on the ICB-inline path. Exploitation requires the ability to mount a crafted UDF image. Patches have been released across multiple stable kernel branches to reject VAT headers that do not leave sufficient room for at least one entry.

Affected products

  • Linux Linux Kernel fa5e08156335 to 0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934

Timeline

  • 2026-06-12: disclosed: Initial patch submission by researcher
  • 2026-07-24: patched: Commits merged into stable branches
  • 2026-07-25: advisory: CVE published

References

Related threats