CVE-2026-64322

A flaw was found in the Linux kernel's Universal Disk Format (UDF) filesystem. The udf_load_sparable_map() function incorrectly validates the length of the sparing table, treating it as a byte count instead of an entry count. This allows a local attacker, by providing a specially crafted UDF image, to trigger an out-of-bounds read and write. This can lead to memory corruption, potentially resulting in a denial of service or arbitrary code execution.

This issue is triggered by a specially crafted disk image containing on-disk metadata inconsistencies. Exploitation requires that an attacker convince a user to download and use a malicious image from an untrusted source, a scenario with limited practical impact. Red Hat rates this as Low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.