CVE-2026-64322 udf: validate sparing table length as an entry count, not a byte count
A crafted UDF image triggers out-of-bounds reads and writes in the Linux kernel UDF driver, potentially allowing code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64322?
CVE-2026-64322 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
udf: validate sparing table length as an entry count, not a byte count
udf_load_sparable_map() accepts a sparing table when
sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize
is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements:
for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry *entry = &st->mapEntry[i]; ... entry->origLocation ... }
in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(*st) + N <= blocksize, yet the consumers index sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write.
Validate reallocationTableLen as the entry count it is, with struct_size().
Weakness: CWE-787
Which versions are affected by CVE-2026-64322?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64322?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64322 being exploited?
There is no known exploitation of CVE-2026-64322 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93593, BELL-CVE-2026-64322, DEBIAN-CVE-2026-64322, GHSA-r2mg-8x37-x2q4, ROOT-OS-DEBIAN-12-CVE-2026-64322, ROOT-OS-UBUNTU-2204-CVE-2026-64322 and 1 more.