CVE-2026-89525: udf: reject VAT indexes equal to the entry count
In the Linux kernel, the following vulnerability has been resolved:
udf: reject VAT indexes equal to the entry count
UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below snumentries.
udfgetpblockvirt15() currently rejects only indexes greater than snumentries. A crafted image can request index snumentries, pass the bounds check, and make the kernel read one entry past the allocated VAT table.
Change the check to reject block >= snumentries, so the count is handled as an exclusive upper bound.
A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udfgetpblockvirt15().
Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the UDF VAT bounds check in udf_get_pblock_virt15() so that VAT indexes use an exclusive upper bound: reject block indices where block >= s_num_entries to avoid reading one entry past the allocated VAT table.
Linux kernel UDF VAT index bounds check in udf_get_pblock_virt15() = Reject VAT indexes equal to the entry count (reject block >= s_num_entries, allow only block < s_num_entries)
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
An attacker needs to provide a crafted UDF image that uses UDF 1.50 virtual partition mapping and requests a VAT index equal to the VAT entry count. Processing that image can cause the kernel to read beyond the allocated VAT table.
What is the likely impact if a vulnerable system processes a malicious image?
The provided reproducer triggers a kernel panic, and KASAN reports a slab out-of-bounds read in udf_get_pblock_virt15(). The data does not establish impacts beyond this out-of-bounds read and demonstrated denial of service.
How can I determine whether a system is affected?
A vulnerable kernel accepts a VAT index equal to s_num_entries because it rejects only indexes greater than the entry count. The corrected behavior rejects indexes greater than or equal to s_num_entries; the listed stable-kernel references identify fixes to check for in the kernel source or applied patch set.