udf: reject descriptors with oversized CRC length

Summary

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.

Timeline

1. Jul 19, 2026, 9:10 AM UTCCVE published
2. Oct 16, 2026, 3:29 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 8:07 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 832ab4a882dc9b3c0155490d9993642ef545fd22; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 7d1b6adbf90df6c8941090d5646fbeca25ba9770; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 3dede76d525919bb966f9213e131af685de5ff99; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 50dfaf4a027742b4fcdc3e9305e7199ece9bc6a6; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 31605bbe94557bff721eaf041001169d44ac6f98; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 1873eb81c65d3f849418d7386baa39c439c9fc38; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in fdb26e628d2a211a23815d375bd33bdf863344e2; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7

• Linux Linux

  2.6.12

• KernelLinux

  From 2.6.12 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.88; From 6.13.0 · fixed in 6.18.30; From 6.19.0 · fixed in 7.0.7

References 8