In the Linux kernel, an out‑of‑bounds read of a bitmap pointer can be triggered by a crafted UDF filesystem extent. The attacker supplies a malicious document image, mounts it via a desktop UDisks/polkit configuration that grants unprivileged users mount rights, and then truncates a writable file on that filesystem. The bug causes a kernel panic, exhausting system availability, but does not expose data or alter system integrity. The underlying flaw is a failure to correctly validate the extent’s offset against the partition length during the free‑block check.

Any system running an affected Linux kernel that accepts removable UDF media. The exact affected kernel versions are not listed, but the issue was fixed in a later patch that revised the bound check logic. All Linux vendors that ship kernels without this patch retain the vulnerability.

The vulnerability is local: it requires the attacker to mount the crafted UDF media. If polkit is configured to allow non‑root users to mount removable media, the exploitation is straightforward. The EPSS score is reported as <1 %, indicating a low daily exploitation probability, and it has not been listed in the CISA KEV catalog. Nevertheless, because the failure leads to a kernel panic, the impact is critical. The CVSS score is 7.8, indicating a high‑severity variant of a denial‑of‑service flaw.