Executive brief
A vulnerability in the Linux kernel's handling of UDF file systems (commonly used on optical media like DVDs) could allow a local user to crash the system. By providing a specially crafted disk image or USB drive, an attacker can trigger a kernel panic, leading to a complete system shutdown and denial of service. This is particularly relevant for desktop systems that automatically allow users to mount removable media.
Technical details
An out-of-bounds read vulnerability exists in the udf_free_blocks() function within the Linux kernel's UDF implementation. The function fails to include the extent offset when validating logical block numbers against the partition length, allowing a crafted extent to pass bounds checks while actually pointing beyond the space bitmap array. An attacker can trigger this by mounting a malicious UDF image and performing an ftruncate(2) operation on a file backed by such an extent, resulting in a kernel panic. The fix involves correctly validating the sum of the logical block number, offset, and count against the partition length and adding range checks in load_block_bitmap().
Affected products
- Linux Linux Kernel All versions prior to the July 2026 patches
Timeline
- 2026-05-15: disclosed: Vulnerability reported and patch submitted by Michael Bommarito.
- 2026-07-25: advisory: CVE-2026-64324 published.
- 2026-07-24: patched: Patches merged into various stable kernel branches.
References
- https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f
- https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3
- https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168
- https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240
- https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c
- https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b
- https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e