In the Linux kernel’s UDF subsystem the udf_load_vat routine copies the VAT header length field directly from the on‑disk structure without validating it against the VAT inode size. Because the lengthHeader value is fully attacker‑controlled, a value larger than the inode size causes an underflow in the calculation of the number of entries, leading to an out‑of‑bounds read of the inode’s data. This memory read can disclose kernel memory contents, which may contain privileged information, and is a classic example of a buffer under‑read (CWE‑125).

The flaw is present in all Linux kernel versions that lack the header‑length validation patch, including the default kernels shipped by major Linux distributions. Any system running a kernel older than the commit that introduced the validation (for example the commit referenced in the advisory links) is affected, regardless of vendor, distribution, or configuration, unless UDF support has been removed.

The CVSS score of 7.1 denotes a high severity for information disclosure, while the EPSS score of < 1 % indicates that the vulnerability is currently considered rarely exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known active exploits. An attacker would need to provide a crafted UDF image – typically via removable media, a network‑mounted share, or a USB drive – and have it mounted on a vulnerable kernel. The exploitation is local in nature; it requires the ability to force the system to read the UDF volume, which may be mitigated by disabling automatic mounting or removing UDF support.