Read the docs
TI-2026-45886 Aliases CVE-2026-64322GHSA-r2mg-8x37-x2q4

udf: validate sparing table length as an entry count, not a byte count

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e. it treats reallocationTableLen as a number of BYTES that must fit in the block. But the table is walked as an array of 8-byte sparingEntry elements: for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) { struct sparingEntry *entry = &st->mapEntry[i]; ... entry->origLocation ... } in udf_get_pblock_spar15() and udf_relocate_blocks(). A reallocationTableLen of N therefore passes the check whenever sizeof(*st) + N <= blocksize, yet the consumers index sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the block. On a crafted UDF image this is an out-of-bounds read in udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the same length to udf_update_tag(), whose crc_itu_t() reads far past the block, and its memmove() through st->mapEntry[] is an out-of-bounds write. Validate reallocationTableLen as the entry count it is, with struct_size().

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00169 6th percentileScored 2026-11-07
Fix Partial Linux (Linux): 2.6.33, 2.6.35, 3.1 +10Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux2.6.32.60 to before 2.6.33; 2.6.34.14 to before 2.6.35; 3.0.37 to before 3.1; 3.2.23 to before 3.3; 3.4.5 to before 3.52.6.33, 2.6.35, 3.1, 3.3, 3.5Patch availableCNA
LinuxLinux3.5 and later5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2Patch availableCNA
  • Linux VendorLinux Affected 2.6.32.60 to before 2.6.33; 2.6.34.14 to before 2.6.35; 3.0.37 to before 3.1; 3.2.23 to before 3.3; 3.4.5 to before 3.5 Fixed in 2.6.33, 2.6.35, 3.1, 3.3, 3.5 Patch available CNA
  • Linux VendorLinux Affected 3.5 and later Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*2.6.32.60 to before 2.6.33; 2.6.34.14 to before 2.6.35; 3.0.37 to before 3.1; 3.2.23 to before 3.3; 3.4.5 to before 3.5; 3.5.1 to before 5.10.261; 5.11 to before 5.15.212; 5.16 to before 6.1.178; 6.2 to before 6.6.145; 6.7 to before 6.12.96; 6.13 to before 6.18.39; 6.19 to before 7.1.4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.5:-:*:*:*:*:*:*3.5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.5:rc5:*:*:*:*:*:*3.5 rc5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.5:rc6:*:*:*:*:*:*3.5 rc6VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.5:rc7:*:*:*:*:*:*3.5 rc7VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 2.6.32.60 to before 2.6.33; 2.6.34.14 to before 2.6.35; 3.0.37 to before 3.1; 3.2.23 to before 3.3; 3.4.5 to before 3.5; 3.5.1 to before 5.10.261; 5.11 to before 5.15.212; 5.16 to before 6.1.178; 6.2 to before 6.6.145; 6.7 to before 6.12.96; 6.13 to before 6.18.39; 6.19 to before 7.1.4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.5:-:*:*:*:*:*:* Versions 3.5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.5:rc5:*:*:*:*:*:* Versions 3.5 rc5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.5:rc6:*:*:*:*:*:* Versions 3.5 rc6 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.5:rc7:*:*:*:*:*:* Versions 3.5 rc7 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 2.6.33, 2.6.35, 3.1, 3.3, 3.5
  • Fix · CNA Linux (Linux) Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-64322
  2. 2026-10-03 Alias added: GHSA-r2mg-8x37-x2q4
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-20 Weakness changed · CISA ADP

References

Patch 8

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences