The Linux kernel's UDF 1.50 virtual partition mapping uses a VAT array to map physical blocks, with s_num_entries indicating the number of entries. Valid indexes must be strictly less than s_num_entries. However, the function udf_get_pblock_virt15() only rejects indexes greater than s_num_entries, allowing an index equal to s_num_entries to pass the check. This results in an out-of-bounds read one entry past the allocated VAT table, causing a slab-out-of-bounds error and potential kernel panic. The issue was identified on the origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53. Trail of Bits has a reproducer that triggers the kernel panic.

A crafted UDF image can exploit this vulnerability to cause an out-of-bounds read in kernel memory, leading to a kernel panic. This may result in denial of service by crashing the system. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that the fix involves changing the bounds check to reject indexes greater than or equal to s_num_entries, treating the count as an exclusive upper bound. Until an official fix is confirmed, avoid mounting untrusted UDF 1.50 virtual partition images.