CVE-2026-64324

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> udf: validate free block extents against the partition length<br /> <br /> udf_free_blocks() checks the logical block number and count against the<br /> partition length, but drops the extent offset from that final bound. A<br /> crafted extent can pass the guard while logicalBlockNum + offset + count<br /> points past the partition, which later indexes past the space bitmap<br /> array.<br /> <br /> A single ftruncate(2) on a file backed by such an extent reliably<br /> panics the kernel. This is a local availability issue. On desktop<br /> systems where UDisks/polkit allows the active user to mount removable<br /> UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply<br /> the crafted filesystem and trigger the panic by truncating a writable<br /> file on it. Systems that require root or CAP_SYS_ADMIN to mount the<br /> image have a higher prerequisite.<br /> <br /> No confidentiality or integrity impact is claimed: the reproduced<br /> primitive is an out-of-bounds read of a bitmap pointer slot followed by<br /> a kernel panic.<br /> <br /> Use the already computed logicalBlockNum + offset + count value for the<br /> partition length check. Also make load_block_bitmap() reject an<br /> out-of-range block group before indexing s_block_bitmap[], so corrupted<br /> callers cannot walk past the flexible array.