CVE-2026-89525Medium· 5.5▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the numbe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 4
none → medium
— → 4
none → medium
— → 5.5
none → medium
0.2% → 0.2%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
udf: reject VAT indexes equal to the entry count
UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries.
udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table.
Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound.
A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15().
Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f64e01a90326bb85a3cc8aa0199931dc2f15b589Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8a8c1c42a34349a0626d910abbad5a29136446b7Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 19f36c6453cd88fe6d60ef36ab1f1cad8ddf4ce4Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b77b83f5529a26d084d64ece98abd6f0cc86e053Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9193368408d792cec2057628d87862140fb1ce1cLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b95c33a4e743874f1b0a45bf2aaa4da553552bd1Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1bd7947f1463c21edafa256d0fbec5b99215e2b6Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cac0cb07f29ccfb373fd4a36c81e908ef3ce608cLinux 2.6.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-57804High· 7.3scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
CVE-2024-47794High· 7.8bpf: Prevent tailcall infinite loop caused by freplace
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing