In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks()… (CVE-2026-64324)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to properly validate free block extents against the partition length and prevent out-of-range bitmap indexing. Users should apply the official kernel updates that include this fix. Systems that require root or CAP_SYS_ADMIN to mount UDF filesystems are less exposed. No additional mitigation is required beyond applying the vendor's patch when available.
Description
In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the guard while logicalBlockNum + offset + count points past the partition, which later indexes past the space bitmap array. A single ftruncate(2) on a file backed by such an extent reliably panics the kernel. This is a local availability issue. On desktop systems where UDisks/polkit allows the active user to mount removable UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply the crafted filesystem and trigger the panic by truncating a writable file on it. Systems that require root or CAP_SYS_ADMIN to mount the image have a higher prerequisite. No confidentiality or integrity impact is claimed: the reproduced primitive is an out-of-bounds read of a bitmap pointer slot followed by a kernel panic. Use the already computed logicalBlockNum + offset + count value for the partition length check. Also make load_block_bitmap() reject an out-of-range block group before indexing s_block_bitmap[], so corrupted callers cannot walk past the flexible array.
Impact
This vulnerability leads to a local denial of service by causing a kernel panic when a specially crafted UDF filesystem extent is accessed and truncated. There is no known impact on confidentiality or integrity. The attack requires local access and the ability to mount or have mounted a crafted UDF filesystem. Systems that restrict mounting to privileged users have a higher barrier to exploitation.
Summary
The Linux kernel's udf_free_blocks() function previously validated logical block numbers and counts against the partition length but omitted the extent offset from this check. This allowed a crafted extent where logicalBlockNum + offset + count exceeded the partition length, leading to an out-of-bounds access of the space bitmap array. Triggering this condition via a file truncation (ftruncate(2)) on a file backed by such an extent causes a kernel panic, resulting in a local denial of service. On systems where unprivileged users can mount UDF media (e.g., desktop systems using UDisks/polkit), this vulnerability can be exploited without elevated privileges. The fix involves using the full sum (logicalBlockNum + offset + count) for boundary validation and adding checks in load_block_bitmap() to reject out-of-range block groups before accessing the bitmap array.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64324 (opens in a new tab)
- git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f (opens in a new tab)
- git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3 (opens in a new tab)
- git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168 (opens in a new tab)
- git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240 (opens in a new tab)
- git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c (opens in a new tab)
- git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b (opens in a new tab)
- git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e (opens in a new tab)
- git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76 (opens in a new tab)