CVE-2026-64324

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the UDF filesystem implementation where the udf free blocks() function fails to include the extent offset when validating the logical block number and count against the partition length. A crafted extent can bypass this check if the sum of logicalBlockNum, offset, and count points beyond the partition, leading to an out-of-bounds read of a bitmap pointer slot. This can be triggered by an unprivileged local user on systems allowing the mounting of removable UDF media without CAP SYS ADMIN privileges by performing an ftruncate(2) operation on a writable file, resulting in a kernel panic and local availability loss.

Recommendations Update the Linux kernel to a version where the udf free blocks() function uses the combined value of logicalBlockNum, offset, and count for partition length validation, and the load block bitmap() function is updated to reject out-of-range block groups before indexing s block bitmap[].