CVE-2026-89525udf: reject VAT indexes equal to the entry count

Official description

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.

Affected packages & fixed versions

Affected products (as reported)

References

• https://git.kernel.org/stable/c/f64e01a90326bb85a3cc8aa0199931dc2f15b589
• https://git.kernel.org/stable/c/8a8c1c42a34349a0626d910abbad5a29136446b7
• https://git.kernel.org/stable/c/19f36c6453cd88fe6d60ef36ab1f1cad8ddf4ce4
• https://git.kernel.org/stable/c/b77b83f5529a26d084d64ece98abd6f0cc86e053
• https://git.kernel.org/stable/c/9193368408d792cec2057628d87862140fb1ce1c
• https://git.kernel.org/stable/c/b95c33a4e743874f1b0a45bf2aaa4da553552bd1
• https://git.kernel.org/stable/c/1bd7947f1463c21edafa256d0fbec5b99215e2b6
• https://git.kernel.org/stable/c/cac0cb07f29ccfb373fd4a36c81e908ef3ce608c