CVE-2026-45991: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45991 Overview

CVE-2026-45991 is a heap out-of-bounds write vulnerability in the Linux kernel's Universal Disk Format (UDF) file system implementation. The flaw resides in handle_partition_descriptor(), which performs deduplication of partition descriptors by partition number but fails to record partnum in appended slots. Mounting a crafted UDF image containing repeated partition descriptors causes num_part_descs to grow unbounded, and a mismatch between allocation sizing and insert indexing eventually triggers a write past the end of the part_descs_loc[] table. The vulnerability affects systems where untrusted UDF images can be mounted, including environments with removable media auto-mount.

Critical Impact
Mounting a malicious UDF image triggers a kernel heap out-of-bounds write, enabling memory corruption that may lead to kernel crash or privilege escalation.

Affected Products

Linux kernel — UDF file system driver (fs/udf)
Distributions shipping affected kernel versions prior to the fixes in commits 058b451, 08841b0, 08fa5d8, and b5597bb
Systems with UDF auto-mount enabled on removable media

Discovery Timeline

2026-05-27 - CVE-2026-45991 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45991

Vulnerability Analysis

The vulnerability is a heap out-of-bounds write in the Linux kernel UDF file system driver. handle_partition_descriptor() maintains an array part_descs_loc[] of partition descriptor entries indexed by num_part_descs. Deduplication is performed using the partnum field of each entry. However, when new entries are appended to the table, the code path does not store the partnum value in the new slot.

As a result, the deduplication check cannot recognize previously appended descriptors. Crafted UDF images containing repeated partition descriptors cause the same descriptor to be appended on every iteration, and num_part_descs grows beyond the intended capacity.

Root Cause

The growth path sizes the backing allocation using ALIGN(partnum, PART_DESC_ALLOC_STEP), while inserts are indexed by num_part_descs. When partnum is already aligned to PART_DESC_ALLOC_STEP, the alignment call returns the existing capacity without expanding it. The next append then writes past the end of the allocated buffer, producing a heap out-of-bounds write [CWE-787]. The two counters track different quantities but are incorrectly used interchangeably for capacity planning.

Attack Vector

An attacker supplies a malicious UDF image containing repeated Partition Descriptors with identical or carefully chosen partition numbers. When the image is mounted, either manually by a privileged user or automatically by a desktop environment handling removable media, the kernel parses the descriptors and triggers the out-of-bounds write. The corruption occurs in kernel heap memory adjacent to part_descs_loc[], which can be leveraged for denial of service or further memory corruption primitives.

The vulnerability mechanism is documented in the upstream fix, which stores partnum in the appended slot and sizes growth from the next append count so that deduplication and capacity tracking follow the same model. See the Kernel Git Commit 058b451 for the authoritative patch.

Detection Methods for CVE-2026-45991

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN report referencing handle_partition_descriptor or part_descs_loc in fs/udf/super.c
Mount attempts of UDF images (.iso, .udf, optical media) from untrusted sources or USB devices
Anomalous mount syscalls invoking the udf file system type immediately preceding kernel instability

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test or staging kernels to surface the out-of-bounds write directly during fuzzing of UDF images
Audit kernel logs (dmesg, journalctl -k) for slab corruption messages or stack traces involving UDF parsing routines
Monitor for mount operations specifying -t udf originating from non-administrative contexts or automated media handlers

Monitoring Recommendations

Forward kernel ring buffer events and audit logs to a centralized log platform and alert on UDF-related stack traces
Track removable-media mount events on endpoints and correlate with subsequent kernel instability or process crashes
Inventory kernel versions across the fleet and flag hosts running versions prior to the fixed commits referenced in the upstream advisory

How to Mitigate CVE-2026-45991

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 058b451, 08841b0, 08fa5d8, and b5597bb or the distribution-supplied kernel update that incorporates them
Disable automatic mounting of removable media in desktop environments and udev rules on untrusted workstations
Restrict the udf file system module via modprobe blacklist on servers that do not require UDF support

Patch Information

The fix stores partnum in the appended slot and sizes the allocation growth from the next append count, aligning deduplication and capacity tracking. Patches are available in the upstream stable trees: Kernel Git Commit 058b451, Kernel Git Commit 08841b0, Kernel Git Commit 08fa5d8, and Kernel Git Commit b5597bb. Rebuild and reboot into the patched kernel after deployment.

Workarounds

Blacklist the UDF kernel module on systems that do not require optical or UDF media support
Disable auto-mount for USB and optical drives in udev, GNOME, and KDE configurations
Limit mount privileges to administrators and avoid mounting UDF images from untrusted sources

bash

# Configuration example: blacklist the udf module and disable autoload
echo 'blacklist udf' | sudo tee /etc/modprobe.d/blacklist-udf.conf
echo 'install udf /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-udf.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep -w udf