Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64323— udf: validate VAT header length against the VAT inode size

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.26版本存在安全漏洞，该漏洞源于未验证VAT头长度，导致整数下溢，可能触发越界读取。

CVSS 7.1 · High EPSS 0.16% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux fa5e08156335d0687c85b4e724db9448fb166601< 0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934 affected
fa5e08156335d0687c85b4e724db9448fb166601< 883962731420ec271ed8c1cd76524f4b17faa982 affected
fa5e08156335d0687c85b4e724db9448fb166601< 2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63 affected
fa5e08156335d0687c85b4e724db9448fb166601< bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb affected
fa5e08156335d0687c85b4e724db9448fb166601< 55287a3555ff0515b3aff181d2c08c0462a41709 affected
fa5e08156335d0687c85b4e724db9448fb166601< e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad affected
fa5e08156335d0687c85b4e724db9448fb166601< 74580fdf022909e184223cacc364feb826982d96 affected
fa5e08156335d0687c85b4e724db9448fb166601< d8202786b3d75125c84ebc4de6d946f92fde0ee8 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64323

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
udf: validate VAT header length against the VAT inode size
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.26版本存在安全漏洞，该漏洞源于未验证VAT头长度，导致整数下溢，可能触发越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux fa5e08156335d0687c85b4e724db9448fb166601 ~ 0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934 -
Linux Linux 2.6.26 -

II. Public POCs for CVE-2026-64323

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64323

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64323 (8)

Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total

CVE-2026-64355 9.8 CRITICAL bpf: Reject fragmented frames in devmap
CVE-2026-64459 9.8 CRITICAL tcp: restore RCU grace period in tcp_ao_destroy_sock
CVE-2026-64303 9.8 CRITICAL spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
CVE-2026-64439 9.8 CRITICAL crypto: krb5 - filter out async aead implementations at alloc
CVE-2026-64410 9.8 CRITICAL netfilter: flowtable: IPIP tunnel hardware offload is not yet support
CVE-2026-64399 9.8 CRITICAL ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
CVE-2026-64397 9.8 CRITICAL ksmbd: serialize QUERY_DIRECTORY requests per file
CVE-2026-64391 9.8 CRITICAL ksmbd: use opener credentials for ADS I/O
CVE-2026-64387 9.8 CRITICAL smb: client: fix query directory replay double-free
CVE-2026-64386 9.8 CRITICAL smb: client: fix query_info() replay double-free
CVE-2026-64385 9.8 CRITICAL smb: client: fix double-free in SMB2_ioctl() replay
CVE-2026-64383 9.8 CRITICAL smb: client: fix double-free in SMB2_flush() replay
CVE-2026-64384 9.8 CRITICAL smb: client: fix change notify replay double-free
CVE-2026-64268 9.8 CRITICAL RDMA/siw: bound Read Response placement to the RREAD length
CVE-2026-64523 9.8 CRITICAL net/handshake: Take a long-lived file reference at submit
CVE-2026-64269 9.1 CRITICAL RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
CVE-2026-64257 9.1 CRITICAL smb: client: reject overlapping data areas in SMB2 responses
CVE-2026-64319 9.1 CRITICAL nvmet-auth: validate reply message payload bounds against transfer length
CVE-2026-64320 9.1 CRITICAL nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
CVE-2026-64393 9.1 CRITICAL ksmbd: run set info with opener credentials

Showing top 20 of 274 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64323

No comments yet

Leave a comment