Strix
64.6K

CVE-2026-89525

UnknownEPSS 0.18%

Last modified

CVE-2026-89525 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.

Metrics

EPSS Probability
0.18%

7.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f64e01a90326bb85a3cc8aa0199931dc2f15b589; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8a8c1c42a34349a0626d910abbad5a29136446b7; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 19f36c6453cd88fe6d60ef36ab1f1cad8ddf4ce4; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b77b83f5529a26d084d64ece98abd6f0cc86e053; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9193368408d792cec2057628d87862140fb1ce1c; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b95c33a4e743874f1b0a45bf2aaa4da553552bd1; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1bd7947f1463c21edafa256d0fbec5b99215e2b6; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < cac0cb07f29ccfb373fd4a36c81e908ef3ce608c
LinuxLinux2.6.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89525?
In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
How severe is CVE-2026-89525?
Severity scoring for CVE-2026-89525 is pending analysis. The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89525?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89525?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST