CVE-2026-64322: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64322 Overview

CVE-2026-64322 is a Linux kernel vulnerability in the Universal Disk Format (UDF) filesystem implementation. The flaw resides in udf_load_sparable_map(), which incorrectly validates the reallocationTableLen field as a byte count rather than an entry count. A crafted UDF filesystem image can trigger out-of-bounds reads in udf_get_pblock_spar15() and out-of-bounds writes in udf_relocate_blocks(), with the consumer functions indexing up to eight times the intended block size.

Critical Impact
A local attacker able to mount a crafted UDF image can trigger out-of-bounds memory access in kernel space, leading to information disclosure, memory corruption, or denial of service.

Affected Products

Linux kernel (UDF filesystem driver)
Distributions shipping vulnerable kernel versions prior to the fix commits referenced by kernel.org
Systems permitting mount operations of removable UDF media by unprivileged users

Discovery Timeline

2026-07-25 - CVE-2026-64322 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64322

Vulnerability Analysis

The UDF sparable partition map handler validates the sparing table with the check sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize. This condition treats reallocationTableLen as a byte count that must fit within a filesystem block. However, downstream code walks the table as an array of 8-byte struct sparingEntry elements.

As a result, a reallocationTableLen value of N passes validation whenever sizeof(*st) + N fits in the block, but consumers subsequently access sizeof(*st) + N * sizeof(struct sparingEntry) bytes. This mismatch produces accesses of roughly eight times the block size beyond the allocated buffer.

In udf_get_pblock_spar15(), the mismatch causes out-of-bounds reads when resolving physical block locations. In udf_relocate_blocks(), the same length value is forwarded to udf_update_tag(), whose crc_itu_t() call reads far past the buffer, and its memmove() through st->mapEntry[] performs an out-of-bounds write.

Root Cause

The root cause is an incorrect length semantic. The validation logic treats a count field as a byte length. The fix uses struct_size() to compute the correct total size, validating reallocationTableLen as the entry count the specification defines.

Attack Vector

Exploitation requires local access with the ability to trigger a mount of an attacker-controlled UDF image. This is reachable through removable media insertion, loop-mounted disk images, or automounters that process untrusted volumes. No network path exists. See the upstream fix at Kernel Git Commit 04f4599 for the corrected validation logic.

Detection Methods for CVE-2026-64322

Indicators of Compromise

Kernel oops or panic messages referencing udf_get_pblock_spar15, udf_relocate_blocks, or udf_update_tag in dmesg or /var/log/kern.log
KASAN reports flagging out-of-bounds access in the UDF module when kernel address sanitizer is enabled
Unexpected mount attempts of UDF-formatted images by non-administrative users

Detection Strategies

Enumerate loaded kernel modules for udf on systems that do not require UDF support and flag its presence for review
Audit mount syscalls with filesystem type udf through auditd or eBPF-based telemetry
Correlate USB or removable media insertion events with subsequent kernel warnings in the UDF subsystem

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging pipeline and alert on UDF-related stack traces
Monitor for user-initiated mount operations of ISO or disk image files from untrusted sources
Track kernel version inventory to identify hosts still running pre-patch kernels

How to Mitigate CVE-2026-64322

Immediate Actions Required

Apply the upstream kernel patches referenced by the kernel.org stable tree commits, or update to a distribution kernel that incorporates the fix
Restrict mounting of UDF filesystems to privileged users by adjusting udev and polkit policies for removable media
Disable the udf kernel module on systems that do not require optical or UDF media support

Patch Information

The fix replaces the byte-based length check with struct_size(), correctly validating reallocationTableLen as an entry count. Fix commits are available at Kernel Git Commit 0a9b79a, Kernel Git Commit 2a219ac, Kernel Git Commit 2d726135, Kernel Git Commit 3ec997b, Kernel Git Commit 7285276, Kernel Git Commit 7f7774b, and Kernel Git Commit eeb0f3e. Apply the patch corresponding to the stable branch in use.

Workarounds

Blacklist the udf module in /etc/modprobe.d/ to prevent automatic loading on systems that never mount UDF media
Configure automounters such as udisks2 to require administrative authorization for filesystem mounts
Enforce read-only mount options and restrict SUID on removable media using noexec,nosuid,nodev mount flags

bash

# Blacklist the UDF module
echo 'blacklist udf' | sudo tee /etc/modprobe.d/blacklist-udf.conf
sudo depmod -a

# Verify current kernel version against fixed release
uname -r