CVE-2026-64323
udf: validate VAT header length against the VAT inode size
Description
In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
INFO
Published Date :
July 25, 2026, 10:17 a.m.
Last Modified :
Aug. 17, 2026, 5:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply the provided patch for the UDF module.
- Recompile the kernel if necessary.
- Mount UDF images with validated header lengths.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64323.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64323 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64323
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64323 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64323 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '883962731420ec271ed8c1cd76524f4b17faa982', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '55287a3555ff0515b3aff181d2c08c0462a41709', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '74580fdf022909e184223cacc364feb826982d96', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'd8202786b3d75125c84ebc4de6d946f92fde0ee8', 'versionType': 'git'}], 'programFiles': ['fs/udf/super.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.26'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.26', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/udf/super.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '883962731420ec271ed8c1cd76524f4b17faa982', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '55287a3555ff0515b3aff181d2c08c0462a41709', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '74580fdf022909e184223cacc364feb826982d96', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'd8202786b3d75125c84ebc4de6d946f92fde0ee8', 'versionType': 'git'}], 'programFiles': ['fs/udf/super.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.26'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.26', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/udf/super.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '883962731420ec271ed8c1cd76524f4b17faa982', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '55287a3555ff0515b3aff181d2c08c0462a41709', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': '74580fdf022909e184223cacc364feb826982d96', 'versionType': 'git'}, {'status': 'affected', 'version': 'fa5e08156335d0687c85b4e724db9448fb166601', 'lessThan': 'd8202786b3d75125c84ebc4de6d946f92fde0ee8', 'versionType': 'git'}], 'programFiles': ['fs/udf/super.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.26'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.26', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/udf/super.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode. Added Reference https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934 Added Reference https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63 Added Reference https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709 Added Reference https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96 Added Reference https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982 Added Reference https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb Added Reference https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8 Added Reference https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad