PT-2026-64544 · Linux · Linux

CVE-2026-64323

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size
udf load vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:
map->s type specific.s virtual.s start offset =
	le16 to cpu(vat20->lengthHeader);
map->s type specific.s virtual.s num entries =
	(sbi->s vat inode->i size -
		map->s type specific.s virtual.s start offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s num entries subtraction underflows to a huge count, which defeats the "block > s num entries" bound in udf get pblock virt15(); and on the ICB-inline path that function reads
(( le32 *)(iinfo->i data + s start offset))[block]
so a large s start offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64323

Affected Products

Linux