CVE-2026-89525: Linux Kernel UDF Buffer Overflow Vulnerability

CVE-2026-89525 Overview

CVE-2026-89525 is an out-of-bounds read vulnerability in the Linux kernel's Universal Disk Format (UDF) filesystem driver. The flaw resides in udf_get_pblock_virt15(), which handles UDF 1.50 virtual partition mapping through the Virtual Allocation Table (VAT). The bounds check incorrectly permits an index equal to s_num_entries, allowing the kernel to read one entry past the allocated VAT table when parsing a crafted UDF image. Trail of Bits reported a KASAN slab-out-of-bounds condition and a reproducer capable of triggering a kernel panic.

Critical Impact
A crafted UDF filesystem image can trigger an out-of-bounds read in the kernel, resulting in denial of service through kernel panic and potential information disclosure from adjacent slab memory.

Affected Products

Linux kernel versions containing the UDF filesystem driver prior to the referenced stable commits
Distributions shipping the vulnerable fs/udf/ implementation of udf_get_pblock_virt15()
Systems that automatically mount UDF-formatted media (optical discs, disk images)

Discovery Timeline

2026-09-11 - CVE-2026-89525 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89525

Vulnerability Analysis

The UDF 1.50 specification uses the Virtual Allocation Table (VAT) as an array mapping logical blocks to physical block locations. The field s_num_entries records the total number of entries in that array. Valid indexes therefore fall within the range 0 to s_num_entries - 1, making s_num_entries an exclusive upper bound.

The function udf_get_pblock_virt15() enforced its bounds check using a strictly greater-than comparison. As a result, an index equal to s_num_entries passed validation. The kernel then dereferenced memory one entry beyond the allocated VAT table, producing a slab-out-of-bounds read detected by Kernel Address Sanitizer (KASAN).

The fix changes the comparison so that any block >= s_num_entries is rejected, treating the count as an exclusive upper bound consistent with the UDF specification.

Root Cause

The defect is an off-by-one boundary condition error. The original code confused an entry count with a maximum valid index, permitting a single out-of-bounds slab read from adjacent kernel memory.

Attack Vector

Exploitation requires the target system to mount a maliciously crafted UDF image. On desktop systems and workstations with automount enabled, inserting removable media or attaching a disk image can be sufficient. On servers, mounting a UDF image typically requires local privileges. Trail of Bits demonstrated a reproducer that triggers a kernel panic against the mainline commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53.

No verified public exploit code is available. See the referenced kernel commits for patch details, including Kernel Commit 8a8c1c4 and Kernel Commit b95c33a.

Detection Methods for CVE-2026-89525

Indicators of Compromise

KASAN slab-out-of-bounds reports in kernel logs referencing udf_get_pblock_virt15 or the fs/udf/ code path.
Unexpected kernel oops or panic events immediately following mount of UDF-formatted media or disk images.
Presence of unfamiliar .iso, .udf, or .img files staged on systems configured to automount removable media.

Detection Strategies

Audit dmesg and journalctl -k output for stack traces originating in the UDF filesystem driver.
Monitor mount syscall telemetry for UDF filesystem types, particularly on production servers where UDF mounting is not expected.
Correlate kernel crash dumps with the presence of removable media insertion or loop device attachment events.

Monitoring Recommendations

Enable persistent kernel crash collection via kdump to preserve evidence of exploitation attempts.
Alert on repeated mount failures involving UDF images from the same user or process context.
Track kernel version inventory across the fleet to identify hosts that have not yet received the patched kernel.

How to Mitigate CVE-2026-89525

Immediate Actions Required

Apply the vendor-supplied kernel updates that include the referenced stable commits as soon as they are available for your distribution.
Disable automatic mounting of removable media on systems that do not require it, particularly for UDF and ISO 9660 filesystems.
Restrict local user ability to mount arbitrary filesystem images by tightening sudo rules and removing unnecessary SUID mount helpers.

Patch Information

The upstream fix reworks the bounds check in udf_get_pblock_virt15() so that any block index greater than or equal to s_num_entries is rejected. The patch is distributed across multiple stable kernel branches through the following commits: 19f36c6, 1bd7947, 8a8c1c4, 9193368, b77b83f, b95c33a, cac0cb0, and f64e01a.

Workarounds

Blocklist the udf kernel module on hosts that do not require UDF filesystem support using modprobe configuration.
Configure udev or desktop environments to prompt before mounting removable optical or disk media rather than automounting.
Enforce mount policies through Mandatory Access Control frameworks such as SELinux or AppArmor to restrict which users may mount UDF filesystems.

bash

# Configuration example: blocklist the udf module until patched kernel is deployed
echo "blacklist udf" | sudo tee /etc/modprobe.d/disable-udf.conf
sudo update-initramfs -u