CVE-2026-45991 Details
Description
In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_descriptor() deduplicates entries by partition number, but appended slots never record partnum. As a result duplicate Partition Descriptors are appended repeatedly and num_part_descs keeps growing. Once the table is full, the growth path still sizes the allocation from partnum even though inserts are indexed by num_part_descs. If partnum is already aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep the old capacity and the next append writes past the end of the table. Store partnum in the appended slot and size growth from the next append count so deduplication and capacity tracking follow the same model.
A heap out-of-bounds write vulnerability has been identified in the Linux kernel's UDF (Universal Disk Format) handling. This issue arises when a crafted UDF image with repeated partition descriptors is mounted. The vulnerability is present in the Linux kernel stable tree. The problem occurs in the 'handle_partition_descriptor()' function, which deduplicates partition entries by number. However, the appended slots do not record the partition number, leading to repeated additions of duplicate partition descriptors. As the 'num_part_descs' counter increases, once the table reaches its capacity, the allocation size is still based on the partition number. If the partition number is aligned to the allocation step, the next write can overflow past the table's end, causing a heap out-of-bounds write.
Users can upgrade to the patched version of the Linux kernel available in the Linux kernel Git repository. Instructions for downloading the latest stable version can be found in the repository's release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.18.7, < 4.19 >= 4.19.1, < 6.6.140 >= 6.7, < 6.12.88 >= 6.13, < 7.0.4 4.19 - 4.19 rc2 4.19 rc3 4.19 rc4 4.19 rc5 4.19 rc6 4.19 rc7 4.19 rc8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |