CVE-2026-89525

A flaw was found in the Linux kernel. A local attacker could craft a malicious Universal Disk Format (UDF) image to trigger an out-of-bounds read vulnerability in the udf_get_pblock_virt15() function. This occurs when the system attempts to read a Virtual Allocation Table (VAT) index equal to the entry count, bypassing a bounds check. This can lead to reading memory beyond the allocated table, potentially causing a kernel panic and a denial of service.

A flaw was found in the Linux kernel's UDF file system implementation, rated by Red Hat as Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). With UDF 1.50 virtual partition mapping, the Virtual Allocation Table (VAT) is used as an array of physical block mappings, and s_num_entries stores the number of entries in that array. The bounds check in udf_get_pblock_virt15() rejects only indexes greater than s_num_entries, so a crafted UDF image can request the index equal to s_num_entries, pass the check, and make the kernel read one entry past the allocated VAT table. A local attacker with the privileges needed to mount a crafted UDF image could use this out-of-bounds read to crash the kernel (kernel panic), resulting in a denial of service; no confidentiality or integrity impact is expected. The kernel and kernel-rt packages in supported Red Hat Enterprise Linux 7 (ELS), 8, 9, and 10 update streams, as well as the RHCOS kernels shipped with OpenShift Container Platform, are affected. Because the impact is Moderate and the CVSS 3.1 score is below 7.0, fixes for the affected streams are deferred, consistent with the Red Hat policy of not filing trackers for Moderate-severity flaws without a higher CVSS score; the residual risk is local denial of service by an attacker able to mount a specially crafted UDF image. The Red Hat Enterprise Linux 6 stream is out of support scope and no fix is planned for it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.