CVE-2026-64323: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64323 Overview

CVE-2026-64323 is an out-of-bounds read vulnerability in the Linux kernel's Universal Disk Format (UDF) file system. The flaw resides in udf_load_vat(), which trusts the lengthHeader field from an on-disk Virtual Allocation Table (VAT) 2.0 header without validating it against the VAT inode size. A crafted UDF image with a virtual (VAT) partition triggers an integer underflow in the entry count calculation, defeating subsequent bounds checks in udf_get_pblock_virt15() and enabling an out-of-bounds read on the ICB-inline path.

Critical Impact
A local attacker able to mount a crafted UDF image can trigger a kernel out-of-bounds read, leading to information disclosure or a denial-of-service condition.

Affected Products

Linux kernel with UDF file system support enabled
Distributions shipping vulnerable kernel versions prior to the referenced stable commits
Systems permitting mounts of untrusted UDF images (removable media, disk images)

Discovery Timeline

2026-07-25 - CVE-2026-64323 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64323

Vulnerability Analysis

The vulnerability exists in the udf_load_vat() function of the Linux kernel UDF driver. The function extracts the virtual partition's start offset from a VAT 2.0 header field named lengthHeader, an attacker-controlled 16-bit value read directly from disk. The kernel assigns this value to s_start_offset and calculates s_num_entries as the VAT inode size minus s_start_offset, right-shifted by two.

When lengthHeader exceeds the VAT inode size, the subtraction underflows because it operates on unsigned arithmetic. The resulting s_num_entries becomes an enormous value. This defeats the block > s_num_entries bounds check in udf_get_pblock_virt15(). On the ICB-inline data path, the function then dereferences ((__le32 *)(iinfo->i_data + s_start_offset))[block], indexing far beyond the inode's in-ICB data buffer.

Root Cause

The root cause is missing input validation of an untrusted on-disk value. The lengthHeader field is not compared against the containing VAT inode size before it participates in pointer arithmetic and size computations. This is a classic Out-of-Bounds Read caused by Improper Input Validation of file system metadata.

Attack Vector

Exploitation requires local access with the ability to mount a UDF file system image. An attacker crafts a malicious UDF image containing a VAT 2.0 header with an oversized lengthHeader value. When the kernel mounts the image and later resolves a virtual block, the out-of-bounds read occurs in kernel context. Attack scenarios include automounting of removable media, container escape paths that permit mount operations, and any workflow that mounts user-supplied disk images.

The patch rejects any VAT whose header length does not leave room for at least one entry within the VAT inode. See the upstream fix in Kernel Git Commit 883962731420 for the reference implementation.

Detection Methods for CVE-2026-64323

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing udf_load_vat or udf_get_pblock_virt15
Mount attempts of UDF images from untrusted sources followed by kernel memory access faults
Presence of UDF images where the VAT 2.0 lengthHeader field exceeds the VAT inode size

Detection Strategies

Audit kernel logs (dmesg, journalctl -k) for UDF driver errors, KASAN reports, or crashes involving virtual partition handling
Monitor mount syscall telemetry for UDF file system types originating from non-administrative processes or removable media
Inspect UDF images offline with tools such as udfinfo to validate VAT header consistency before mounting

Monitoring Recommendations

Enable auditd rules on the mount and mount_setattr syscalls to capture UDF mount activity
Alert on kernel ring buffer messages tagged with UDF-fs errors, particularly around VAT parsing
Track removable media insertion events and correlate them with subsequent kernel faults

How to Mitigate CVE-2026-64323

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0ad2d09a, 2900e02a, 55287a35, 74580fdf, 88396273, bb0d384c, d8202786, and e610fb11 once packaged by your distribution
Disable automatic mounting of removable media on servers and shared workstations until patched kernels are deployed
Restrict the ability of unprivileged users and containers to invoke mount on UDF file systems

Patch Information

The fix has been merged across multiple stable branches. Reference commits include Kernel Git Commit 0ad2d09a, Kernel Git Commit 2900e02a, Kernel Git Commit 55287a35, Kernel Git Commit 74580fdf, Kernel Git Commit 88396273, Kernel Git Commit bb0d384c, Kernel Git Commit d8202786, and Kernel Git Commit e610fb11. Update to the distribution-provided kernel that incorporates these fixes and reboot affected systems.

Workarounds

Blacklist the udf kernel module on systems that do not require UDF support using /etc/modprobe.d/
Configure udev and desktop environments to disable auto-mounting of optical and USB media
Enforce noexec, nosuid, and nodev mount options on removable media mount points to reduce blast radius

bash

# Blacklist the UDF module until a patched kernel is deployed
echo 'blacklist udf' | sudo tee /etc/modprobe.d/disable-udf.conf
echo 'install udf /bin/true' | sudo tee -a /etc/modprobe.d/disable-udf.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep -w udf