CVE-2026-93055: UDF symlink pathComponent header OOB read
In the Linux kernel, the following vulnerability has been resolved:
UDF symlink pathComponent header OOB read
udfsymlinkfiller() can enter udfpctochar() with a partial pathComponent header.
Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed symlink data that would otherwise make udfpctochar() perform an out-of-bounds read.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to provide to trigger the out-of-bounds read?
The attacker needs malformed UDF symlink data containing a partial pathComponent header. The vulnerable code can pass that incomplete header to udf_pc_to_char(), resulting in an out-of-bounds read.
What is the mitigation if the fix cannot be applied immediately?
Reject or avoid processing malformed UDF symlink data, particularly data with incomplete pathComponent headers. The resolved code mitigates the issue by verifying that enough input remains for a complete header before accessing it.
How can I determine whether the issue is fixed in a kernel source tree?
Check whether udf_symlink_filler() validates that sufficient input remains for a complete pathComponent header before calling or accessing data through udf_pc_to_char(). The referenced stable commits contain the correction.