CVE-2026-64322

CVE CVE-2026-64322EUVD EUVD-2026-49034Published 2026-07-25T08:49:50.000ZLast changed 2026-08-05T12:40:59.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements: for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry *entry = &st->mapEntry[i]; ... entry->origLocation ... } in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(*st) + N <= blocksize, yet the consumers index sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write. Validate reallocationTableLen as the entry count it is, with struct_size().

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 2.6.32.60 <2.6.33; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <2d726135099313958f8975532a2e15322ff150ce; b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa; patch: 6.6.145; a9f1af04f086656246f30354fb4564ce3b08c4a0; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <7f7774b9da0ef17b87bfa238cf966ad0b3376150; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9; 3.5; 9ae30e324a96d0328a575329d7a95a09b3318601; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <7285276aa50d2839afb5957ffd491ad282dc8f72; patch: 6.12.96; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <3ec997bd5508e9b25210b5bbec89031629cdb093; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <2a219acb2ce674d99bbd1b7b35ed8c384dac7200; e240873cb4a9fd18de60a817100a96fe670d4359; patch: 7.2-rc1; 2.6.34.14 <2.6.35; 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 <04f4599a9efb90992d072a814960edf0cd62805d; patch: 5.10.261; 3.2.23 <3.3; patch: 6.18.39; patch: 0; 3.0.37 <3.1; 3.4.5 <3.5; patch: 6.1.178; patch: 7.1.4; patch: 5.15.212; 4836ee563d65bb492f907cbe267a5761b9693e4d

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.