In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC… (CVE-2026-53369)

The Linux kernel's udf_read_tagged() function did not properly validate the descCRCLength field in UDF descriptors. When descCRCLength plus the size of the tag structure exceeded the block size, CRC verification was skipped, allowing a crafted UDF image to bypass CRC validation entirely. This vulnerability could allow acceptance of malformed descriptors based solely on an 8-bit tag checksum. The issue has been fixed by rejecting descriptors with oversized CRC lengths instead of silently accepting them.

This vulnerability could allow an attacker to bypass CRC validation in the UDF file system, potentially leading to acceptance of malformed or malicious descriptors. The CVSS score of 8.4 indicates high impact on confidentiality, integrity, and availability. Exploitation could compromise system security by processing crafted UDF images that bypass integrity checks. However, no known exploits in the wild have been reported.

A patch is available and should be applied by updating the Linux kernel to the fixed versions. After updating, a system reboot is required to apply the changes. The vendor advisory from Ubuntu confirms the availability of official fixes. Users should follow standard system update procedures to remediate this vulnerability. No additional mitigation actions are specified or required beyond applying the official patch.