CVE-2026-89525

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udf: reject VAT indexes equal to the entry count

UDF 1.50 virtual partition mapping uses the VAT as an array of physical

block mappings. s_num_entries stores the number of entries in that array,

not the highest valid index. The valid VAT indexes are therefore below

s_num_entries.

udf_get_pblock_virt15() currently rejects only indexes greater than

s_num_entries. A crafted image can request index s_num_entries, pass the

bounds check, and make the kernel read one entry past the allocated VAT table.

Change the check to reject block >= s_num_entries, so the count is handled as

an exclusive upper bound.

A crafted UDF image reproduced this on origin/master commit

0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds

report in udf_get_pblock_virt15().

Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References