CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved:

udf: reject VAT indexes equal to the entry count

UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s num entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s num entries.

udf get pblock virt15() currently rejects only indexes greater than s num entries. A crafted image can request index s num entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table.

Change the check to reject block >= s num entries, so the count is handled as an exclusive upper bound.

A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf get pblock virt15().

Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.