CVE-2026-64323

A flaw was found in the Linux kernel's Universal Disk Format (UDF) filesystem. A local attacker could craft a malicious UDF image with a specially formed Virtual Allocation Table (VAT) header. When this image is mounted, the kernel fails to properly validate the VAT header length against the VAT inode size. This can lead to an out-of-bounds read, potentially causing a system crash or information disclosure.

A crafted UDF image with a virtual VAT partition can set an attacker controlled VAT 2.0 lengthHeader that is larger than the VAT inode size. This makes the VAT entry count underflow to a very large value and can bypass the normal block count validation in udf_get_pblock_virt15. On the ICB inline path the kernel can then read past the inode inline data using iinfo i_data plus the attacker controlled start offset, resulting in a kernel out of bounds read. For the CVSS the PR:L is used because practical triggering requires a local user or local service path able to cause the crafted UDF image to be mounted, rather than a remote packet only trigger. The issue is not network reachable by itself. Impact is at least local denial of service via kernel crash. In the paranoid interpretation, limited confidentiality impact is possible because the primitive is an out of bounds kernel read, but there is no strong evidence of arbitrary write or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.