PT-2026-64544 · Linux · Linux

CVE-2026-64323

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size
udf load vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:
map->s type specific.s virtual.s start offset =
	le16 to cpu(vat20->lengthHeader);
map->s type specific.s virtual.s num entries =
	(sbi->s vat inode->i size -
		map->s type specific.s virtual.s start offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s num entries subtraction underflows to a huge count, which defeats the "block > s num entries" bound in udf get pblock virt15(); and on the ICB-inline path that function reads
(( le32 *)(iinfo->i data + s start offset))[block]
so a large s start offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64323

Produtos afetados

Linux