The Linux kernel's udf_load_vat() function reads the virtual partition's start offset directly from the on-disk VAT 2.0 header without validating it against the VAT inode size. The lengthHeader field, which is attacker-controlled, can exceed the VAT inode size, causing an underflow in the calculation of s_num_entries. This underflow allows s_num_entries to become a large value, bypassing bounds checks in udf_get_pblock_virt15(), leading to an out-of-bounds read from inode data. The vulnerability is triggered by mounting a maliciously crafted UDF image with a virtual partition. The fix involves validating the VAT header length to ensure it leaves space for at least one entry within the VAT inode.

An attacker can cause an out-of-bounds read in kernel memory by mounting a specially crafted UDF image with a virtual partition. This could potentially lead to information disclosure or kernel instability. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states it has been resolved by rejecting VAT headers with invalid length, indicating a fix is available or planned. Until an official fix is applied, avoid mounting untrusted UDF images with virtual partitions.