Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-64322

udf: validate sparing table length as an entry count, not a byte count

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.6.33, 2.6.35, 3.1, 3.3, 3.5, and 7 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements: for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry *entry = &st->mapEntry[i]; ... entry->origLocation ... } in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(*st) + N <= blocksize, yet the consumers index sizeof(st) + N sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write. Validate reallocationTableLen as the entry count it is, with struct_size().

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 2d726135099313958f8975532a2e15322ff150ce; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 7285276aa50d2839afb5957ffd491ad282dc8f72; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 2a219acb2ce674d99bbd1b7b35ed8c384dac7200; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 04f4599a9efb90992d072a814960edf0cd62805d; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 7f7774b9da0ef17b87bfa238cf966ad0b3376150; From 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 · fixed in 3ec997bd5508e9b25210b5bbec89031629cdb093; From 2.6.32.60 · fixed in 2.6.33; From 2.6.34.14 · fixed in 2.6.35; From 3.0.37 · fixed in 3.1; From 3.2.23 · fixed in 3.3; From 3.4.5 · fixed in 3.5

  • Linux Linux

    3.5

  • KernelLinux

    From 3.5.0 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.96; From 6.13.0 · fixed in 6.18.39; From 6.19.0 · fixed in 7.1.4

References 8

git.kernel.org