CVE-2026-64324

The CVE-2026-64324 issue affects the Linux kernel UDF handling. In udf_free_blocks(), the check against partition length used logicalBlockNum and count but drops the extent offset, allowing a crafted extent to pass guard checks and cause an out-of-bounds access when indexing the space bitmap, pot...

EUVD-2026-48868

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

CVE-2026-64324 udf: validate free block extents against the partition length

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

CVE-2026-64323 udf: validate VAT header length against the VAT inode size

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64322

Mode C: Normal. The CVE-2026-64322 issue affects the Linux kernel UDF handling of sparing tables. The problem is that udf_load_sparable_map() validated reallocationTableLen as a byte count, while code walks the sparing table as an array of 8-byte entries, leading to potential out-of-bounds reads ...

CVE-2026-64324: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

Linux Distros Unpatched Vulnerability : CVE-2026-64324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops th...

PT-2026-64544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur when mounting a crafted UDF image with a virtual VAT partition. The udf load vat function fails to validate the lengthHeader value from the on-disk VAT 2....

PT-2026-64545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UDF filesystem implementation where the udf free blocks function fails to include the extent offset when validating the logical block number and count against the...

Linux Distros Unpatched Vulnerability : CVE-2026-64322

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst +...

Linux Distros Unpatched Vulnerability : CVE-2026-64323

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header witho...

CVE-2026-64322: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64323: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache CVE-2026-31402 In the Linux kernel, the following vulnerability has been resolved: ext4: validate pidx bounds in ext4extcorrectindexes CVE-2026-31449 In the Lin...

CVE-2026-53369

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

CVE-2026-53369 udf: reject descriptors with oversized CRC length

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

CVE-2026-53369

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

CVE-2026-53369: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

CVE-2026-62350 TDengine: UDF lead to RCE

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side...

CVE-2026-62355: Improper Privilege Management

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader adminuser on a TDengine Cloud DB instance could run create udf even though standard users should have read-only permissions for non-database objects and show dnodes and crea...