CVE-2026-64323: udf: validate VAT header length against the VAT inode size
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size
udfloadvat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:
map->stypespecific.svirtual.sstartoffset = le16tocpu(vat20->lengthHeader); map->stypespecific.svirtual.snumentries = (sbi->svatinode->isize - map->stypespecific.svirtual.sstartoffset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the snumentries subtraction underflows to a huge count, which defeats the "block > snumentries" bound in udfgetpblockvirt15(); and on the ICB-inline path that function reads
((le32 )(iinfo->idata + sstartoffset))[block]
so a large sstartoffset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate the on-disk VAT 2.0 header length (lengthHeader) against the VAT inode size, and reject the VAT unless the header leaves room for at least one entry.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that mount UDF images containing a virtual (VAT) partition are exposed. Exploitation requires local access and the ability to cause the system to mount a crafted UDF image.
What does an attacker need to control?
The attacker needs a crafted UDF image with a VAT 2.0 header whose lengthHeader value exceeds the VAT inode size. This attacker-controlled 16-bit value causes an entry-count underflow and can lead to an out-of-bounds read during mounting.
Is a patch available, and what should be done?
A patch is available. Apply the vendor or stable-kernel update containing the VAT header-length validation before mounting untrusted UDF media or images.