CVE-2026-64324

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udf: validate free block extents against the partition length

udf_free_blocks() checks the logical block number and count against the

partition length, but drops the extent offset from that final bound. A

crafted extent can pass the guard while logicalBlockNum + offset + count

points past the partition, which later indexes past the space bitmap

array.

A single ftruncate(2) on a file backed by such an extent reliably

panics the kernel. This is a local availability issue. On desktop

systems where UDisks/polkit allows the active user to mount removable

UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply

the crafted filesystem and trigger the panic by truncating a writable

file on it. Systems that require root or CAP_SYS_ADMIN to mount the

image have a higher prerequisite.

No confidentiality or integrity impact is claimed: the reproduced

primitive is an out-of-bounds read of a bitmap pointer slot

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References