Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-25T00:00:00 kernel: udf: validate sparing table length as an entry count, not a byte count 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements: for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry *entry = &st->mapEntry[i]; ... entry->origLocation ... } in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(*st) + N <= blocksize, yet the consumers index sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write. Validate reallocationTableLen as the entry count it is, with struct_size().

A flaw was found in the Linux kernel's Universal Disk Format (UDF) filesystem. The udf_load_sparable_map() function incorrectly validates the length of the sparing table, treating it as a byte count instead of an entry count. This allows a local attacker, by providing a specially crafted UDF image, to trigger an out-of-bounds read and write. This can lead to memory corruption, potentially resulting in a denial of service or arbitrary code execution.

This issue is triggered by a specially crafted disk image containing on-disk metadata inconsistencies. Exploitation requires that an attacker convince a user to download and use a malicious image from an untrusted source, a scenario with limited practical impact. Red Hat rates this as Low severity. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-64322 https://nvd.nist.gov/vuln/detail/CVE-2026-64322 https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64322-c496@gregkh/T