The vulnerability stems from the UDF driver interpreting the sparing table length field as a byte count instead of an entry count. During validation the kernel checks that the sum of the table header size and the reported length fits within a filesystem block, but the subsequent code treats that length as the number of eight‑byte entries. This mismatch allows the driver to read beyond the block boundary when locating sparing entries and to write beyond the block when relocating blocks, resulting in out‑of‑bounds memory accesses that can corrupt kernel memory. An attacker who can supply a crafted UDF image that is processed by the target system could exploit these violations to leak sensitive data or potentially execute arbitrary code, as the corruption occurs in kernel space.

All Linux kernel releases that contain the unpatched UDF code are affected. No explicit kernel version range is listed, so any kernel prior to the patch that added proper length validation for the sparing table is considered vulnerable.

The CVSS score of 7.8 indicates a high severity impact. The EPSS score of <1 % suggests that current exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a malicious UDF image that the system mounts or processes; this is inferred from the fact that the bug manifests when the kernel parses the sparing table during UDF image handling. No publicly documented workaround exists, so the risk depends on how the environment restricts or validates UDF images and how quickly the vulnerability is remedied.