CVE-2026-64322 - Vulnerability Details

- udf: validate sparing table length as an entry count, not a byte count

Description

In the Linux kernel, the following vulnerability has been resolved:

udf: validate sparing table length as an entry count, not a byte count

udf_load_sparable_map() accepts a sparing table when

sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize

is false, i.e. it treats reallocationTableLen as a number of BYTES that
must fit in the block. But the table is walked as an array of 8-byte
sparingEntry elements:

for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {
struct sparingEntry *entry = &st->mapEntry[i];
... entry->origLocation ...
}

in udf_get_pblock_spar15() and udf_relocate_blocks(). A
reallocationTableLen of N therefore passes the check whenever
sizeof(*st) + N <= blocksize, yet the consumers index
sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the
block. On a crafted UDF image this is an out-of-bounds read in
udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the
same length to udf_update_tag(), whose crc_itu_t() reads far past the
block, and its memmove() through st->mapEntry[] is an out-of-bounds
write.

Validate reallocationTableLen as the entry count it is, with
struct_size().

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The UDF driver incorrectly treats the sparing table length field as a byte count during validation, while later processing interprets it as a count of eight‑byte sparingEntry structures. This mismatch allows the driver to read beyond the filesystem block boundary during the sparing table walk and to write beyond the block when relocating blocks, resulting in out‑of‑bounds memory accesses that corrupt kernel memory.

Affected Systems

All Linux kernel releases that have not yet incorporated the patch for the UDF driver are affected. The CNA and CPE data cover the kernel as a whole, including versions 3.5 and prior releases, meaning any kernel without the fix for this specific logic flaw is vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, and the EPSS score of < 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a malicious UDF image that triggers the fault while the kernel parses the sparing table; this is inferred from the description of how the bug manifests during UDF image handling.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 2d726135099313958f8975532a2e15322ff150ce
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 7285276aa50d2839afb5957ffd491ad282dc8f72
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 2a219acb2ce674d99bbd1b7b35ed8c384dac7200
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 04f4599a9efb90992d072a814960edf0cd62805d
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 7f7774b9da0ef17b87bfa238cf966ad0b3376150
`1df2ae31c724e57be9d7ac00d78db8a5dabdd050`	affected	< 3ec997bd5508e9b25210b5bbec89031629cdb093
`e240873cb4a9fd18de60a817100a96fe670d4359`	affected	—
`9ae30e324a96d0328a575329d7a95a09b3318601`	affected	—
`b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa`	affected	—
`a9f1af04f086656246f30354fb4564ce3b08c4a0`	affected	—
`4836ee563d65bb492f907cbe267a5761b9693e4d`	affected	—
`2.6.32.60`	affected	< 2.6.33
`2.6.34.14`	affected	< 2.6.35
`3.0.37`	affected	< 3.1
`3.2.23`	affected	< 3.3
`3.4.5`	affected	< 3.5

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:3.5:-::::::
	cpe:2.3:o:linux:linux_kernel:3.5:rc5::::::
	cpe:2.3:o:linux:linux_kernel:3.5:rc6::::::
	cpe:2.3:o:linux:linux_kernel:3.5:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,2d726135099313958f8975532a2e15322ff150ce)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,7285276aa50d2839afb5957ffd491ad282dc8f72)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,2a219acb2ce674d99bbd1b7b35ed8c384dac7200)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,04f4599a9efb90992d072a814960edf0cd62805d)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,7f7774b9da0ef17b87bfa238cf966ad0b3376150)`	affected	code_commit	—
`[1df2ae31c724e57be9d7ac00d78db8a5dabdd050,3ec997bd5508e9b25210b5bbec89031629cdb093)`	affected	code_commit	—
`e240873cb4a9fd18de60a817100a96fe670d4359`	affected	code_commit	—
`9ae30e324a96d0328a575329d7a95a09b3318601`	affected	code_commit	—
`b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa`	affected	code_commit	—
`a9f1af04f086656246f30354fb4564ce3b08c4a0`	affected	code_commit	—
`4836ee563d65bb492f907cbe267a5761b9693e4d`	affected	code_commit	—
`[2.6.32.60,2.6.33)`	affected	generic	—
`[2.6.34.14,2.6.35)`	affected	generic	—
`[3.0.37,3.1)`	affected	semver	—
`[3.2.23,3.3)`	affected	semver	—
`[3.4.5,3.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	semver	—
`[0,3.5)`	unaffected	generic	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that validates sparingTableLen as an entry count; upgrade to a kernel release that includes the fix.
If patching cannot be performed immediately, disable UDF filesystem support in the kernel configuration (remove CONFIG_UDF_FS) or unload the driver.
Restrict or block the use of UDF files on production systems; reject or quarantine any non‑system‑generated UDF images before mounting.
Enable kernel hardening features such as KASLR, SMEP, SMAP, and memory randomization to reduce the impact of any successful exploitation.

Generated by OpenCVE AI on September 4, 2026 at 23:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00169.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d
https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9
https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200
https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce
https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093
https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72
https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150
https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e
https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64322-c496@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64322
https://www.cve.org/CVERecord?id=CVE-2026-64322

History

Fri, 04 Sep 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
CPEs		cpe:2.3:o:linux:linux_kernel:3.5:-:::::: cpe:2.3:o:linux:linux_kernel:3.5:rc5:::::: cpe:2.3:o:linux:linux_kernel:3.5:rc6:::::: cpe:2.3:o:linux:linux_kernel:3.5:rc7::::::

Sat, 01 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-126

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64322-c496@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64322 https://www.cve.org/CVERecord?id=CVE-2026-64322
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 26 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-125 CWE-126

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements: for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry entry = &st->mapEntry[i]; ... entry->origLocation ... } in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(st) + N <= blocksize, yet the consumers index sizeof(st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write. Validate reallocationTableLen as the entry count it is, with struct_size().
Title		udf: validate sparing table length as an entry count, not a byte count
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9 https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200 https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093 https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72 https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150 https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:50.180Z

Updated: 2026-08-17T04:53:23.900Z

Reserved: 2026-07-19T15:36:31.780Z

Link: CVE-2026-64322

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:13.640

Modified: 2026-09-04T14:52:46.270

Link: CVE-2026-64322

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64322 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-05T00:00:07Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object