CVE-2026-64323

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read can occur when mounting a crafted UDF image with a virtual (VAT) partition. The udf load vat() function fails to validate the lengthHeader value from the on-disk VAT 2.0 header against the VAT inode size. Because lengthHeader is attacker-controlled, a value exceeding the VAT inode size causes the s num entries calculation to underflow, resulting in an excessively large count. This bypasses the boundary check in udf get pblock virt15(), allowing the function to index past the inode's in-ICB data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.