CVE-2026-64322

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> udf: validate sparing table length as an entry count, not a byte count<br /> <br /> udf_load_sparable_map() accepts a sparing table when<br /> <br /> sizeof(*st) + le16_to_cpu(st-&gt;reallocationTableLen) &gt; sb-&gt;s_blocksize<br /> <br /> is false, i.e. it treats reallocationTableLen as a number of BYTES that<br /> must fit in the block. But the table is walked as an array of 8-byte<br /> sparingEntry elements:<br /> <br /> for (i = 0; i reallocationTableLen); i++) {<br /> struct sparingEntry *entry = &amp;st-&gt;mapEntry[i];<br /> ... entry-&gt;origLocation ...<br /> }<br /> <br /> in udf_get_pblock_spar15() and udf_relocate_blocks(). A<br /> reallocationTableLen of N therefore passes the check whenever<br /> sizeof(*st) + N mapEntry[] is an out-of-bounds<br /> write.<br /> <br /> Validate reallocationTableLen as the entry count it is, with<br /> struct_size().