CVE-2026-64322

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udf: validate sparing table length as an entry count, not a byte count

udf_load_sparable_map() accepts a sparing table when

sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize

is false, i.e. it treats reallocationTableLen as a number of BYTES that

must fit in the block. But the table is walked as an array of 8-byte

sparingEntry elements:

for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {

struct sparingEntry *entry = &st->mapEntry[i];

... entry->origLocation ...

}

in udf_get_pblock_spar15() and udf_relocate_blocks(). A

reallocationTableLen of N therefore passes the check whenever

sizeof(*st) + N <= blocksize, yet the consumers index

sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the

block. On a crafted UDF image this is an out-of-bounds read in

udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the

same length to udf_update_tag(), whose crc_it

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References