The Linux kernel's udf_read_tagged() function skipped CRC verification when the sum of descCRCLength and the size of the tag structure exceeded the block size. This allowed a crafted UDF image to specify an oversized descCRCLength, bypassing CRC validation entirely. The descriptor was then accepted based only on an 8-bit tag checksum, which is trivially recomputable, potentially allowing malicious images to be accepted by the kernel. The fix involves rejecting descriptors with oversized CRC lengths rather than silently accepting them. This vulnerability affects certain Linux kernel versions prior to the fixed releases indicated by Ubuntu advisories.

Exploitation of this vulnerability could allow an attacker to bypass integrity checks on UDF file system descriptors, potentially leading to acceptance of maliciously crafted file system images. This could result in compromise of system confidentiality, integrity, and availability. The CVSS 3.1 base score of 8.4 reflects high impact on confidentiality, integrity, and availability with low attack complexity and no required privileges or user interaction.

An official patch is available and has been released by Ubuntu and the Linux kernel maintainers. Users should update their Linux kernel packages to the fixed versions as specified in the vendor advisories and reboot the system to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigations are required beyond applying the official updates.