CVE-2026-64323 (GCVE-0-2026-64323)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:53
VLAI
Title
udf: validate VAT header length against the VAT inode size
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934 (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 883962731420ec271ed8c1cd76524f4b17faa982 (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63 (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 55287a3555ff0515b3aff181d2c08c0462a41709 (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 74580fdf022909e184223cacc364feb826982d96 (git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < d8202786b3d75125c84ebc4de6d946f92fde0ee8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.26
Unaffected: 0 , < 2.6.26 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "883962731420ec271ed8c1cd76524f4b17faa982",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "55287a3555ff0515b3aff181d2c08c0462a41709",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "74580fdf022909e184223cacc364feb826982d96",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            },
            {
              "lessThan": "d8202786b3d75125c84ebc4de6d946f92fde0ee8",
              "status": "affected",
              "version": "fa5e08156335d0687c85b4e724db9448fb166601",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate VAT header length against the VAT inode size\n\nudf_load_vat() takes the virtual partition\u0027s start offset straight from\nthe on-disk VAT 2.0 header without checking it against the VAT inode\nsize:\n\n\tmap-\u003es_type_specific.s_virtual.s_start_offset =\n\t\tle16_to_cpu(vat20-\u003elengthHeader);\n\tmap-\u003es_type_specific.s_virtual.s_num_entries =\n\t\t(sbi-\u003es_vat_inode-\u003ei_size -\n\t\t\tmap-\u003es_type_specific.s_virtual.s_start_offset) \u003e\u003e 2;\n\nlengthHeader is a fully attacker-controlled 16-bit value.  If it exceeds\nthe VAT inode size, the s_num_entries subtraction underflows to a huge\ncount, which defeats the \"block \u003e s_num_entries\" bound in\nudf_get_pblock_virt15(); and on the ICB-inline path that function reads\n\n\t((__le32 *)(iinfo-\u003ei_data + s_start_offset))[block]\n\nso a large s_start_offset indexes past the inode\u0027s in-ICB data.  Mounting\na crafted UDF image with a virtual (VAT) partition then triggers an\nout-of-bounds read.\n\nReject a VAT whose header length does not leave room for at least one\nentry within the VAT inode."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable parser is reached by mounting a crafted local UDF image or removable volume; no network-facing protocol reaches it.\nAC:L - The VAT type, inline allocation, header length, and virtual block index are attacker-controlled on disk, with no race or uncontrollable condition required.\nPR:L - Although direct mounting requires init-namespace CAP_SYS_ADMIN, common UDisks/polkit deployments let an active unprivileged local user create a loop device and request the mount.\nUI:N - In the low-privilege UDisks scenario, the attacker can initiate the mount and trigger VAT resolution without another user\u0027s action.\nS:U - The vulnerable UDF parser and affected kernel resources remain within the host kernel\u0027s security authority.\nC:H - The underflow permits repeatable 32-bit reads at attacker-selected offsets potentially many gigabytes beyond the VAT buffer, enabling disclosure of kernel memory.\nI:N - The primitive only reads a mapping value, and virtual UDF partitions are forcibly read-only; no kernel-memory write primitive results.\nA:H - A sufficiently large attacker-selected index can fault in kernel context and cause an oops or panic, enabling repeatable system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:25.005Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934"
        },
        {
          "url": "https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982"
        },
        {
          "url": "https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb"
        },
        {
          "url": "https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709"
        },
        {
          "url": "https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad"
        },
        {
          "url": "https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8"
        }
      ],
      "title": "udf: validate VAT header length against the VAT inode size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64323",
    "datePublished": "2026-07-25T08:49:51.097Z",
    "dateReserved": "2026-07-19T15:36:31.780Z",
    "dateUpdated": "2026-08-17T04:53:25.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64323",
      "date": "2026-09-21",
      "epss": "0.00164",
      "percentile": "0.06034"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:46:35.000Z",
      "cve": "CVE-2026-64323",
      "id": "msrc_CVE-2026-64323",
      "initial_release_date": "2026-07-26T01:04:27.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "udf: validate VAT header length against the VAT inode size",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64323.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/udf/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "883962731420ec271ed8c1cd76524f4b17faa982",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "55287a3555ff0515b3aff181d2c08c0462a41709",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "74580fdf022909e184223cacc364feb826982d96",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d8202786b3d75125c84ebc4de6d946f92fde0ee8",
                    "status": "affected",
                    "version": "fa5e08156335d0687c85b4e724db9448fb166601",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/udf/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.26"
                  },
                  {
                    "lessThan": "2.6.26",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "937840F4-EA62-4516-B4EB-5272A94CEF0E",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "2.6.26",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate VAT header length against the VAT inode size\n\nudf_load_vat() takes the virtual partition\u0027s start offset straight from\nthe on-disk VAT 2.0 header without checking it against the VAT inode\nsize:\n\n\tmap-\u003es_type_specific.s_virtual.s_start_offset =\n\t\tle16_to_cpu(vat20-\u003elengthHeader);\n\tmap-\u003es_type_specific.s_virtual.s_num_entries =\n\t\t(sbi-\u003es_vat_inode-\u003ei_size -\n\t\t\tmap-\u003es_type_specific.s_virtual.s_start_offset) \u003e\u003e 2;\n\nlengthHeader is a fully attacker-controlled 16-bit value.  If it exceeds\nthe VAT inode size, the s_num_entries subtraction underflows to a huge\ncount, which defeats the \"block \u003e s_num_entries\" bound in\nudf_get_pblock_virt15(); and on the ICB-inline path that function reads\n\n\t((__le32 *)(iinfo-\u003ei_data + s_start_offset))[block]\n\nso a large s_start_offset indexes past the inode\u0027s in-ICB data.  Mounting\na crafted UDF image with a virtual (VAT) partition then triggers an\nout-of-bounds read.\n\nReject a VAT whose header length does not leave room for at least one\nentry within the VAT inode."
          }
        ],
        "id": "CVE-2026-64323",
        "lastModified": "2026-09-04T14:52:25.060",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:13.790",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T18:32:23+00:00",
      "cve": "CVE-2026-64323",
      "id": "CVE-2026-64323",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "274",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: udf: validate VAT header length against the VAT inode size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64323.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:41:47Z",
      "cve": "CVE-2026-64323",
      "id": "CVE-2026-64323",
      "initial_release_date": "2026-07-25T16:45:43Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "721",
      "product_status:recommended": "111",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64323",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64323.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.