CVE-2026-45991

What it actually does

This is a local Linux kernel memory-corruption vulnerability in the UDF filesystem parser. When a crafted UDF disk image contains repeated Partition Descriptors, the kernel's UDF mount logic can incorrectly append descriptor metadata without properly tracking deduplication and allocation size. Under the right layout, the descriptor table can become full and the next append can write past the end of a heap allocation. Because the flaw occurs in kernel context while mounting or probing a filesystem image, successful exploitation can potentially corrupt kernel memory and lead to local privilege escalation, kernel crash, or arbitrary kernel-code execution, depending on kernel build, hardening, and exploit reliability.

Why it matters to the business

An attacker who can get a crafted UDF image mounted or auto-probed on a Linux system may be able to crash the system or elevate privileges to full control of the host. The most realistic exposure is on desktops, workstations, build systems, virtualization hosts, file-processing services, forensic sandboxes, or servers that automatically inspect or mount uploaded disk images, optical media images, removable media, or virtual disks. Although public exploitation is not currently indicated and EPSS is low, the impact is high because successful exploitation occurs in the kernel and can compromise confidentiality, integrity, and availability of the affected system.

How an attack unfolds

An attacker prepares a malicious UDF filesystem image with repeated Partition Descriptors arranged to trigger incorrect descriptor-table growth during mount processing. The attacker then needs the target system to mount, auto-mount, or otherwise probe the crafted image using the vulnerable Linux kernel UDF filesystem code. This could occur through removable media, a downloaded ISO or disk image, a virtual machine image workflow, a file-analysis pipeline, or a service that mounts user-supplied archives or images. During UDF mount handling, the kernel repeatedly appends descriptor entries, miscalculates capacity, and writes beyond the allocated heap buffer. The resulting heap corruption can cause an immediate kernel panic or, with a reliable exploit and favorable kernel conditions, allow the attacker to manipulate kernel memory and gain elevated privileges.

How to fix it

Upgrade affected Linux kernels to a vendor release that includes the UDF partition descriptor bookkeeping fix. Because no specific fixed versions were provided, use distribution security advisories and kernel changelogs for the exact patched package version for each supported platform. Where immediate patching is not possible, reduce exposure by preventing untrusted users and services from mounting disk images, disabling automatic mounting/probing of removable media and downloaded images, restricting mount privileges to trusted administrators, and blocking or unloading the UDF filesystem module where UDF support is not required. For systems that process untrusted files, avoid mounting submitted images directly on production hosts; use isolated disposable sandboxes with patched kernels and strong containment.

How to confirm the fix worked

Confirm that all relevant systems are running a kernel build from the operating-system vendor that contains the UDF fix. Validate exposure by checking whether UDF support is available through loaded modules, built-in kernel configuration, or filesystem registration. Attempt to load or mount only benign UDF media in a controlled test environment to ensure business workflows still function after patching or disabling UDF. Confirm that auto-mount services and image-processing pipelines do not mount untrusted UDF images without isolation. For package-based systems, verify installed kernel package versions against the vendor advisory rather than relying only on upstream version numbers, because distributions often backport fixes.

Typical attack path

1. Attacker creates a crafted UDF image containing repeated Partition Descriptors designed to exhaust and corrupt the kernel descriptor table.
2. Attacker delivers the image through removable media, downloaded ISO/image content, virtual disk workflows, shared storage, or an upload path that causes filesystem probing.
3. A vulnerable Linux system mounts, auto-mounts, or scans the UDF image using the in-kernel UDF filesystem driver.
4. The UDF parser mishandles descriptor deduplication and allocation growth, causing a heap out-of-bounds write in kernel memory.
5. The system experiences a kernel crash, or the attacker leverages the corruption for local privilege escalation or kernel-level execution.

How to detect it

Historical exploitation is difficult to prove from logs alone because successful kernel memory corruption may leave only a crash, panic, or generic kernel fault. Review system logs, kernel journals, crash dumps, and EDR telemetry for UDF mounts or auto-mount activity followed by kernel oops, panic, KASAN, slab, or general-protection-fault messages. Relevant log sources include journald, syslog, kern.log, dmesg archives, auditd, udisks/desktop auto-mount logs, container or sandbox execution logs, and file-ingestion service logs. Look for mounting of ISO/UDF images from untrusted paths, removable-media events, loop-device creation, invocations of mount helpers with filesystem type udf, and crashes involving UDF filesystem functions such as partition descriptor handling. On systems with crash dump collection enabled, inspect vmcore/oops traces for UDF-related stack frames and heap out-of-bounds indicators. Treat any unexplained kernel crash shortly after mounting or probing a UDF image as suspicious, especially if the image originated from an external user or untrusted source.

• UDF-fs:
• mount -t udf
• type=udf
• FSTYPE=udf
• udisksd
• systemd-udevd
• /sbin/mount.udf
• /usr/bin/mount
• /dev/loop
• BUG: KASAN: slab-out-of-bounds
• BUG: KASAN: heap-out-of-bounds
• kernel BUG
• general protection fault
• Oops:
• Kernel panic
• handle_partition_descriptor
• part_descs_loc
• fs/udf
• udf:

What your security team should do

• Prioritize patching Linux desktops, jump boxes, developer workstations, virtualization hosts, file-ingestion systems, forensic/sandbox environments, and any service that mounts or inspects user-supplied disk images.
• Disable or restrict automatic mounting of removable media and downloaded disk images, especially UDF/ISO content, until patched kernels are deployed.
• Restrict mount capabilities and device/media access for non-administrative users; review use of sudo rules, container privileges, loop devices, and helper services that allow mounting images.
• If UDF is not operationally required, block or unload the UDF kernel module and prevent it from being auto-loaded.
• Review file-processing and malware-analysis pipelines to ensure untrusted images are processed in disposable, patched, isolated environments rather than mounted on shared hosts.
• Monitor kernel logs for UDF mount activity, kernel oops, slab out-of-bounds reports, or panics associated with UDF parsing.
• Track distribution advisories for the exact fixed kernel packages and include this issue in recurring kernel patch compliance checks.