CVE-2026-64322 (GCVE-0-2026-64322)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:53
VLAI
Title
udf: validate sparing table length as an entry count, not a byte count
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements: for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry *entry = &st->mapEntry[i]; ... entry->origLocation ... } in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(*st) + N <= blocksize, yet the consumers index sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write. Validate reallocationTableLen as the entry count it is, with struct_size().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9 (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 2d726135099313958f8975532a2e15322ff150ce (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 7285276aa50d2839afb5957ffd491ad282dc8f72 (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 2a219acb2ce674d99bbd1b7b35ed8c384dac7200 (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 04f4599a9efb90992d072a814960edf0cd62805d (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 7f7774b9da0ef17b87bfa238cf966ad0b3376150 (git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 3ec997bd5508e9b25210b5bbec89031629cdb093 (git)
Affected: e240873cb4a9fd18de60a817100a96fe670d4359 (git)
Affected: 9ae30e324a96d0328a575329d7a95a09b3318601 (git)
Affected: b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa (git)
Affected: a9f1af04f086656246f30354fb4564ce3b08c4a0 (git)
Affected: 4836ee563d65bb492f907cbe267a5761b9693e4d (git)
Affected: 2.6.32.60 , < 2.6.33 (semver)
Affected: 2.6.34.14 , < 2.6.35 (semver)
Affected: 3.0.37 , < 3.1 (semver)
Affected: 3.2.23 , < 3.3 (semver)
Affected: 3.4.5 , < 3.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.5
Unaffected: 0 , < 3.5 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "2d726135099313958f8975532a2e15322ff150ce",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "7285276aa50d2839afb5957ffd491ad282dc8f72",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "2a219acb2ce674d99bbd1b7b35ed8c384dac7200",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "04f4599a9efb90992d072a814960edf0cd62805d",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "7f7774b9da0ef17b87bfa238cf966ad0b3376150",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "lessThan": "3ec997bd5508e9b25210b5bbec89031629cdb093",
              "status": "affected",
              "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e240873cb4a9fd18de60a817100a96fe670d4359",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9ae30e324a96d0328a575329d7a95a09b3318601",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a9f1af04f086656246f30354fb4564ce3b08c4a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4836ee563d65bb492f907cbe267a5761b9693e4d",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.33",
              "status": "affected",
              "version": "2.6.32.60",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.35",
              "status": "affected",
              "version": "2.6.34.14",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1",
              "status": "affected",
              "version": "3.0.37",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.23",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.32.60",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.34.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.0.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate sparing table length as an entry count, not a byte count\n\nudf_load_sparable_map() accepts a sparing table when\n\n\tsizeof(*st) + le16_to_cpu(st-\u003ereallocationTableLen) \u003e sb-\u003es_blocksize\n\nis false, i.e. it treats reallocationTableLen as a number of BYTES that\nmust fit in the block.  But the table is walked as an array of 8-byte\nsparingEntry elements:\n\n\tfor (i = 0; i \u003c le16_to_cpu(st-\u003ereallocationTableLen); i++) {\n\t\tstruct sparingEntry *entry = \u0026st-\u003emapEntry[i];\n\t\t... entry-\u003eorigLocation ...\n\t}\n\nin udf_get_pblock_spar15() and udf_relocate_blocks().  A\nreallocationTableLen of N therefore passes the check whenever\nsizeof(*st) + N \u003c= blocksize, yet the consumers index\nsizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the\nblock.  On a crafted UDF image this is an out-of-bounds read in\nudf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the\nsame length to udf_update_tag(), whose crc_itu_t() reads far past the\nblock, and its memmove() through st-\u003emapEntry[] is an out-of-bounds\nwrite.\n\nValidate reallocationTableLen as the entry count it is, with\nstruct_size()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A crafted UDF image must be presented and mounted as local loop or removable block media; no network-facing path reaches this parser.\nAC:L - The attacker deterministically controls the entry count, table contents, block size, and accessed packet, with no race or condition outside attacker control.\nPR:L - Direct mounting requires initial-namespace CAP_SYS_ADMIN and user namespaces do not help, but common UDisks/polkit configurations let an active unprivileged local user mount attacker-controlled loop or removable media through a privileged broker.\nUI:N - The local attacker can request the brokered mount and trigger block translation themselves, requiring no action by a separate victim.\nS:U - Exploitation compromises the host kernel within its existing security authority and does not inherently cross a VM, IOMMU, or other scope boundary.\nC:H - The malformed count permits reads up to roughly eight times beyond the block, and relocation can expose adjacent kernel data through copied entries or returned mapping values.\nI:H - udf_relocate_blocks performs an out-of-bounds origLocation store and attacker-sized memmove through mapEntry[], potentially corrupting adjacent kernel pages and enabling control-flow hijacking.\nA:H - The extensive out-of-bounds reads and writes can reliably cause a kernel oops, panic, or fatal memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:23.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200"
        },
        {
          "url": "https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093"
        }
      ],
      "title": "udf: validate sparing table length as an entry count, not a byte count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64322",
    "datePublished": "2026-07-25T08:49:50.180Z",
    "dateReserved": "2026-07-19T15:36:31.780Z",
    "dateUpdated": "2026-08-17T04:53:23.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64322",
      "date": "2026-09-22",
      "epss": "0.00169",
      "percentile": "0.06602"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:41:50.000Z",
      "cve": "CVE-2026-64322",
      "id": "msrc_CVE-2026-64322",
      "initial_release_date": "2026-07-26T01:11:19.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "udf: validate sparing table length as an entry count, not a byte count",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64322.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/udf/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d726135099313958f8975532a2e15322ff150ce",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7285276aa50d2839afb5957ffd491ad282dc8f72",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a219acb2ce674d99bbd1b7b35ed8c384dac7200",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "04f4599a9efb90992d072a814960edf0cd62805d",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7f7774b9da0ef17b87bfa238cf966ad0b3376150",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ec997bd5508e9b25210b5bbec89031629cdb093",
                    "status": "affected",
                    "version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e240873cb4a9fd18de60a817100a96fe670d4359",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "9ae30e324a96d0328a575329d7a95a09b3318601",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a9f1af04f086656246f30354fb4564ce3b08c4a0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "4836ee563d65bb492f907cbe267a5761b9693e4d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2.6.33",
                    "status": "affected",
                    "version": "2.6.32.60",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.6.35",
                    "status": "affected",
                    "version": "2.6.34.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.1",
                    "status": "affected",
                    "version": "3.0.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.3",
                    "status": "affected",
                    "version": "3.2.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.5",
                    "status": "affected",
                    "version": "3.4.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/udf/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.5"
                  },
                  {
                    "lessThan": "3.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "571B40BF-08B7-41AC-806B-0E35A53D328E",
                    "versionEndExcluding": "2.6.33",
                    "versionStartIncluding": "2.6.32.60",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C1AC9B20-1038-4F47-A063-9EE430E432F3",
                    "versionEndExcluding": "2.6.35",
                    "versionStartIncluding": "2.6.34.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75F31EC0-3D1C-48F0-A8B9-0B5A519046DD",
                    "versionEndExcluding": "3.1",
                    "versionStartIncluding": "3.0.37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FC48A9C2-AC26-44CD-B13A-F46DF05DDD3C",
                    "versionEndExcluding": "3.3",
                    "versionStartIncluding": "3.2.23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "12003DF5-A23E-4886-9953-702081F7FC56",
                    "versionEndExcluding": "3.5",
                    "versionStartIncluding": "3.4.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3300EEBE-67F9-4024-8019-0ACE4F414608",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "3.5.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:3.5:-:*:*:*:*:*:*",
                    "matchCriteriaId": "71555F5B-DEB2-417A-8E33-90276DD2EFB8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:3.5:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "7F0CC423-9BE8-4B1C-8179-E3E24693BEAA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:3.5:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "F9893E78-1974-4ED0-B4DB-CD2F9161E61A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:3.5:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "1E1655C7-B886-47A0-AF2B-B54A25AA91FF",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate sparing table length as an entry count, not a byte count\n\nudf_load_sparable_map() accepts a sparing table when\n\n\tsizeof(*st) + le16_to_cpu(st-\u003ereallocationTableLen) \u003e sb-\u003es_blocksize\n\nis false, i.e. it treats reallocationTableLen as a number of BYTES that\nmust fit in the block.  But the table is walked as an array of 8-byte\nsparingEntry elements:\n\n\tfor (i = 0; i \u003c le16_to_cpu(st-\u003ereallocationTableLen); i++) {\n\t\tstruct sparingEntry *entry = \u0026st-\u003emapEntry[i];\n\t\t... entry-\u003eorigLocation ...\n\t}\n\nin udf_get_pblock_spar15() and udf_relocate_blocks().  A\nreallocationTableLen of N therefore passes the check whenever\nsizeof(*st) + N \u003c= blocksize, yet the consumers index\nsizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the\nblock.  On a crafted UDF image this is an out-of-bounds read in\nudf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the\nsame length to udf_update_tag(), whose crc_itu_t() reads far past the\nblock, and its memmove() through st-\u003emapEntry[] is an out-of-bounds\nwrite.\n\nValidate reallocationTableLen as the entry count it is, with\nstruct_size()."
          }
        ],
        "id": "CVE-2026-64322",
        "lastModified": "2026-09-04T14:52:46.270",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:13.640",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T17:54:25+00:00",
      "cve": "CVE-2026-64322",
      "id": "CVE-2026-64322",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: udf: validate sparing table length as an entry count, not a byte count",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64322.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.