udf: validate VAT header length against the VAT inode size

...

SUSE CVE-2026-64323

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64323

CVE-2026-64323 affects the Linux kernel UDF filesystem handling. The bug is in udf_load_vat() where the virtual partition start offset is taken from vat20->lengthHeader without validating against the VAT inode size, allowing a fully attacker-controlled 16-bit lengthHeader to underflow s_num_en...

EUVD-2026-49035

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64323

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...