Executive brief
The Linux kernel's UDF (Universal Disk Format) filesystem implementation contains an off-by-one bounds check error in virtual partition table (VAT) handling. An attacker can craft a malicious UDF image that triggers an out-of-bounds memory read when the kernel processes the crafted filesystem, potentially causing a kernel panic or information disclosure.
Technical details
The vulnerability exists in the udf_get_pblock_virt15() function in fs/udf/partition.c, which handles UDF 1.50 virtual partition mapping. The function uses s_num_entries to track the number of valid VAT entries but incorrectly validates VAT array indexes using a "greater than" check instead of "greater than or equal to." This allows an attacker to supply a VAT index equal to s_num_entries, which passes the insufficient bounds check and causes the kernel to read one entry beyond the allocated VAT table. The fix changes the bounds check from `block > s_num_entries` to `block >= s_num_entries`. The vulnerability affects all Linux kernel versions since at least 2.6.12 and has been fixed via patch cac0cb07f29ccfb373fd4a36c81e908ef3ce608c. Exploitation requires the ability to provide a crafted UDF filesystem image to the target system.
Affected products
- Linux Linux kernel 2.6.12 and later
Timeline
- 2026-09-11: disclosed: CVE-2026-89525 published
- 2026-09-14: patched: Fix committed to Linux stable tree