The Linux kernel's udf_free_blocks() function previously validated logical block numbers and counts against the partition length but omitted the extent offset from this check. This allowed a crafted extent where logicalBlockNum + offset + count exceeded the partition length, leading to an out-of-bounds access of the space bitmap array. Triggering this condition via a file truncation (ftruncate(2)) on a file backed by such an extent causes a kernel panic, resulting in a local denial of service. On systems where unprivileged users can mount UDF media (e.g., desktop systems using UDisks/polkit), this vulnerability can be exploited without elevated privileges. The fix involves using the full sum (logicalBlockNum + offset + count) for boundary validation and adding checks in load_block_bitmap() to reject out-of-range block groups before accessing the bitmap array.

This vulnerability leads to a local denial of service by causing a kernel panic when a specially crafted UDF filesystem extent is accessed and truncated. There is no known impact on confidentiality or integrity. The attack requires local access and the ability to mount or have mounted a crafted UDF filesystem. Systems that restrict mounting to privileged users have a higher barrier to exploitation.

A fix has been implemented in the Linux kernel to properly validate free block extents against the partition length and prevent out-of-range bitmap indexing. Users should apply the official kernel updates that include this fix. Systems that require root or CAP_SYS_ADMIN to mount UDF filesystems are less exposed. No additional mitigation is required beyond applying the vendor's patch when available.