The vulnerability resides in the Linux kernel UDF filesystem code, specifically the udf_read_tagged() function. When a descriptor’s CRC length plus the size of the tag structure exceeds the block size, the function skips CRC verification. An attacker can craft a UDF image with an oversized CRC length to force this skip. The kernel then accepts the descriptor solely on the basis of a trivial 8‑bit tag checksum, which can be recomputed at will. This improper input validation flaw (CWE‑354) allows the system to ingest malformed descriptors without detecting corruption, undermining filesystem integrity and any data processed from it.

All Linux kernel installations that have not applied the patch for CVE‑2026‑53369 are affected. This includes every distribution that includes the stock Linux kernel image, regardless of version, because the vulnerable code resides in the core kernel module that handles UDF media.

The CVSS score of 8.4 indicates a high severity, while the EPSS score of <1% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the flaw can be exploited by a local attacker who supplies a crafted UDF image, such as via a removable CD/DVD or USB drive that the system mounts. The attack vector is local and requires the kernel to mount a UDF filesystem. The impact is primarily data integrity loss through acceptance of malformed descriptors, which could lead to corrupted data being processed by kernel or user‑space applications.