CVE-2026-64324 (GCVE-0-2026-64324)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the guard while logicalBlockNum + offset + count points past the partition, which later indexes past the space bitmap array. A single ftruncate(2) on a file backed by such an extent reliably panics the kernel. This is a local availability issue. On desktop systems where UDisks/polkit allows the active user to mount removable UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply the crafted filesystem and trigger the panic by truncating a writable file on it. Systems that require root or CAP_SYS_ADMIN to mount the image have a higher prerequisite. No confidentiality or integrity impact is claimed: the reproduced primitive is an out-of-bounds read of a bitmap pointer slot followed by a kernel panic. Use the already computed logicalBlockNum + offset + count value for the partition length check. Also make load_block_bitmap() reject an out-of-range block group before indexing s_block_bitmap[], so corrupted callers cannot walk past the flexible array.
References
Impacted products
Vendor Product Version
Linux Linux Version: 934f815345c09c290a9b9a9cfdddc203ec2117e8
Version: 22cc7323f090646c8cfb5939e6f15bdc2ed3fd27
Version: 7c4fa9ebfce69619d132fe703dc2e2cf62a13723
Version: 5cc9745e2ea11aef7d5c9a42bc36f6cd3e1b4cc3
Version: 56e69e59751d20993f243fb7dd6991c4e522424c
Version: 56e69e59751d20993f243fb7dd6991c4e522424c
Version: 56e69e59751d20993f243fb7dd6991c4e522424c
Version: 56e69e59751d20993f243fb7dd6991c4e522424c
Version: 097420e48e30f51e8f4f650b5c946f5af63ec1a3
Version: 5def895b42ef16a2da6402818cba8d7ec8ede1ef
Version: 05fb2bf477d3fe5421bd4cb699574737f52bd88b
Version: 5.10.224   ≤
Version: 5.15.165   ≤
Version: 6.1.105   ≤
Version: 6.6.46   ≤
Version: 4.19.320   ≤
Version: 5.4.282   ≤
Version: 6.10.5   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64324",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:39:12.321827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:38:24.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/balloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fdd6229d2ae9914c1f25d1041db0f4f312a4fa76",
              "status": "affected",
              "version": "934f815345c09c290a9b9a9cfdddc203ec2117e8",
              "versionType": "git"
            },
            {
              "lessThan": "b54aee5652fcd7c23a0904a4623ec462c3edc70c",
              "status": "affected",
              "version": "22cc7323f090646c8cfb5939e6f15bdc2ed3fd27",
              "versionType": "git"
            },
            {
              "lessThan": "12af328d2ee8d68e81ba612246d0b54b22d23e1f",
              "status": "affected",
              "version": "7c4fa9ebfce69619d132fe703dc2e2cf62a13723",
              "versionType": "git"
            },
            {
              "lessThan": "fb49099206c5c57af28a157249fa7bcb5518f99e",
              "status": "affected",
              "version": "5cc9745e2ea11aef7d5c9a42bc36f6cd3e1b4cc3",
              "versionType": "git"
            },
            {
              "lessThan": "9442d75429b0c556292a7454fe888d54259f5240",
              "status": "affected",
              "version": "56e69e59751d20993f243fb7dd6991c4e522424c",
              "versionType": "git"
            },
            {
              "lessThan": "335202ab25b01fdd45889ff25eab70864686dea3",
              "status": "affected",
              "version": "56e69e59751d20993f243fb7dd6991c4e522424c",
              "versionType": "git"
            },
            {
              "lessThan": "be87de7789a82a030a4896bc7683415ec9fa6f2b",
              "status": "affected",
              "version": "56e69e59751d20993f243fb7dd6991c4e522424c",
              "versionType": "git"
            },
            {
              "lessThan": "5f0419457f89dce1a3f1c8e62a3adf2f39ab8168",
              "status": "affected",
              "version": "56e69e59751d20993f243fb7dd6991c4e522424c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "097420e48e30f51e8f4f650b5c946f5af63ec1a3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5def895b42ef16a2da6402818cba8d7ec8ede1ef",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05fb2bf477d3fe5421bd4cb699574737f52bd88b",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/balloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.224",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.46",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.320",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.282",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate free block extents against the partition length\n\nudf_free_blocks() checks the logical block number and count against the\npartition length, but drops the extent offset from that final bound.  A\ncrafted extent can pass the guard while logicalBlockNum + offset + count\npoints past the partition, which later indexes past the space bitmap\narray.\n\nA single ftruncate(2) on a file backed by such an extent reliably\npanics the kernel.  This is a local availability issue.  On desktop\nsystems where UDisks/polkit allows the active user to mount removable\nUDF media without CAP_SYS_ADMIN, an unprivileged local user can supply\nthe crafted filesystem and trigger the panic by truncating a writable\nfile on it.  Systems that require root or CAP_SYS_ADMIN to mount the\nimage have a higher prerequisite.\n\nNo confidentiality or integrity impact is claimed: the reproduced\nprimitive is an out-of-bounds read of a bitmap pointer slot followed by\na kernel panic.\n\nUse the already computed logicalBlockNum + offset + count value for the\npartition length check.  Also make load_block_bitmap() reject an\nout-of-range block group before indexing s_block_bitmap[], so corrupted\ncallers cannot walk past the flexible array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached through a local ftruncate(2) on a crafted, mounted UDF filesystem; no network protocol reaches this path.\nAC:L - The attacker controls the malicious extent and truncation offset, and a single ftruncate(2) reliably triggers the fault without a race or uncontrollable condition.\nPR:L - UDF cannot be mounted through an unprivileged user namespace, but default [UDisks policy](https://storaged.org/doc/udisks2-api/latest/udisks-polkit-ac tions.html) permits an active unprivileged user to mount removable media without administrator authentication.\nUI:N - The attacking local user can mount the supplied removable filesystem and truncate its writable file directly; no separate victim action is required.\nS:U - The vulnerable UDF code and the affected kernel resources remain within the host kernel\u0027s security authority; ordinary kernel privilege escalation does not change scope.\nC:H - Although the reproduced path is an out-of-bounds pointer-slot read followed by panic, a zero-valued out-of-range slot causes read_block_bitmap() to write a buffer_head pointer through that attacker-selected slot. Under the required higher-severity rule, this exploitable kernel heap corruption can enable code execution and unrestricted disclosure.\nI:H - The conditional out-of-bounds buffer_head pointer store corrupts kernel heap memory at an attacker-selected array index and can potentially alter control-relevant objects. This supports control-flow hijacking or arbitrary modification under the required higher-severity assumption.\nA:H - The [upstream report](https://lkml.iu.edu/2605.1/15216.html) confirms that one ftruncate(2) reliably panics the kernel, causing complete system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:26.109Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76"
        },
        {
          "url": "https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c"
        },
        {
          "url": "https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240"
        },
        {
          "url": "https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3"
        },
        {
          "url": "https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168"
        }
      ],
      "title": "udf: validate free block extents against the partition length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64324",
    "datePublished": "2026-07-25T08:49:52.063Z",
    "dateReserved": "2026-07-19T15:36:31.780Z",
    "dateUpdated": "2026-10-19T20:38:24.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-64324\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:39:12.321827Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:39:12.912Z\"}}], \"cna\": {\"title\": \"udf: validate free block extents against the partition length\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The flaw is reached through a local ftruncate(2) on a crafted, mounted UDF filesystem; no network protocol reaches this path.\\nAC:L - The attacker controls the malicious extent and truncation offset, and a single ftruncate(2) reliably triggers the fault without a race or uncontrollable condition.\\nPR:L - UDF cannot be mounted through an unprivileged user namespace, but default [UDisks policy](https://storaged.org/doc/udisks2-api/latest/udisks-polkit-ac tions.html) permits an active unprivileged user to mount removable media without administrator authentication.\\nUI:N - The attacking local user can mount the supplied removable filesystem and truncate its writable file directly; no separate victim action is required.\\nS:U - The vulnerable UDF code and the affected kernel resources remain within the host kernel\u0027s security authority; ordinary kernel privilege escalation does not change scope.\\nC:H - Although the reproduced path is an out-of-bounds pointer-slot read followed by panic, a zero-valued out-of-range slot causes read_block_bitmap() to write a buffer_head pointer through that attacker-selected slot. Under the required higher-severity rule, this exploitable kernel heap corruption can enable code execution and unrestricted disclosure.\\nI:H - The conditional out-of-bounds buffer_head pointer store corrupts kernel heap memory at an attacker-selected array index and can potentially alter control-relevant objects. This supports control-flow hijacking or arbitrary modification under the required higher-severity assumption.\\nA:H - The [upstream report](https://lkml.iu.edu/2605.1/15216.html) confirms that one ftruncate(2) reliably panics the kernel, causing complete system unavailability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"934f815345c09c290a9b9a9cfdddc203ec2117e8\", \"lessThan\": \"fdd6229d2ae9914c1f25d1041db0f4f312a4fa76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"22cc7323f090646c8cfb5939e6f15bdc2ed3fd27\", \"lessThan\": \"b54aee5652fcd7c23a0904a4623ec462c3edc70c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7c4fa9ebfce69619d132fe703dc2e2cf62a13723\", \"lessThan\": \"12af328d2ee8d68e81ba612246d0b54b22d23e1f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5cc9745e2ea11aef7d5c9a42bc36f6cd3e1b4cc3\", \"lessThan\": \"fb49099206c5c57af28a157249fa7bcb5518f99e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"56e69e59751d20993f243fb7dd6991c4e522424c\", \"lessThan\": \"9442d75429b0c556292a7454fe888d54259f5240\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"56e69e59751d20993f243fb7dd6991c4e522424c\", \"lessThan\": \"335202ab25b01fdd45889ff25eab70864686dea3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"56e69e59751d20993f243fb7dd6991c4e522424c\", \"lessThan\": \"be87de7789a82a030a4896bc7683415ec9fa6f2b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"56e69e59751d20993f243fb7dd6991c4e522424c\", \"lessThan\": \"5f0419457f89dce1a3f1c8e62a3adf2f39ab8168\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"097420e48e30f51e8f4f650b5c946f5af63ec1a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5def895b42ef16a2da6402818cba8d7ec8ede1ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"05fb2bf477d3fe5421bd4cb699574737f52bd88b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.224\", \"lessThan\": \"5.10.261\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.165\", \"lessThan\": \"5.15.212\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.105\", \"lessThan\": \"6.1.178\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.46\", \"lessThan\": \"6.6.145\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.320\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.282\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.10.5\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/udf/balloc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.261\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.212\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.178\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.145\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.39\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.1.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/udf/balloc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76\"}, {\"url\": \"https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c\"}, {\"url\": \"https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f\"}, {\"url\": \"https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e\"}, {\"url\": \"https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240\"}, {\"url\": \"https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3\"}, {\"url\": \"https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b\"}, {\"url\": \"https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudf: validate free block extents against the partition length\\n\\nudf_free_blocks() checks the logical block number and count against the\\npartition length, but drops the extent offset from that final bound.  A\\ncrafted extent can pass the guard while logicalBlockNum + offset + count\\npoints past the partition, which later indexes past the space bitmap\\narray.\\n\\nA single ftruncate(2) on a file backed by such an extent reliably\\npanics the kernel.  This is a local availability issue.  On desktop\\nsystems where UDisks/polkit allows the active user to mount removable\\nUDF media without CAP_SYS_ADMIN, an unprivileged local user can supply\\nthe crafted filesystem and trigger the panic by truncating a writable\\nfile on it.  Systems that require root or CAP_SYS_ADMIN to mount the\\nimage have a higher prerequisite.\\n\\nNo confidentiality or integrity impact is claimed: the reproduced\\nprimitive is an out-of-bounds read of a bitmap pointer slot followed by\\na kernel panic.\\n\\nUse the already computed logicalBlockNum + offset + count value for the\\npartition length check.  Also make load_block_bitmap() reject an\\nout-of-range block group before indexing s_block_bitmap[], so corrupted\\ncallers cannot walk past the flexible array.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.261\", \"versionStartIncluding\": \"5.10.224\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.212\", \"versionStartIncluding\": \"5.15.165\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.178\", \"versionStartIncluding\": \"6.1.105\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.145\", \"versionStartIncluding\": \"6.6.46\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.96\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.39\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1.4\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.320\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.282\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.10.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-17T04:53:26.109Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-64324\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T20:38:24.164Z\", \"dateReserved\": \"2026-07-19T15:36:31.780Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-07-25T08:49:52.063Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.