CVE-2026-64323 udf: validate VAT header length against the VAT inode size
A crafted UDF image triggers an out-of-bounds read in the Linux kernel, potentially causing a crash or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64323?
CVE-2026-64323 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size
udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:
map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads
((__le32 *)(iinfo->i_data + s_start_offset))[block]
so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
Which versions are affected by CVE-2026-64323?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64323?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64323 being exploited?
There is no known exploitation of CVE-2026-64323 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93413, BELL-CVE-2026-64323, DEBIAN-CVE-2026-64323, GHSA-rjqr-92w7-gfg4, ROOT-OS-DEBIAN-12-CVE-2026-64323, ROOT-OS-UBUNTU-2204-CVE-2026-64323 and 1 more.