CVE-2026-64322

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the UDF file system implementation where the udf load sparable map() function incorrectly treats the reallocationTableLen variable as a byte count instead of an entry count when validating the sparing table length. Because the table is processed as an array of 8-byte sparingEntry elements in udf get pblock spar15() and udf relocate blocks(), a crafted UDF image can trigger an out-of-bounds read. Additionally, udf relocate blocks() passes this length to udf update tag(), which can lead to an out-of-bounds read via crc itu t() and an out-of-bounds write via memmove() through the mapEntry array.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.