CVE-2026-93055

What it actually does

Out-of-bounds read in udf_pc_to_char() when udf_symlink_filler() supplies a partial pathComponent header from malformed UDF symlink data.

Why it matters to the business

Systems handling untrusted UDF images risk kernel memory disclosure or crashes, potentially leading to data leaks or denial of service on file servers and embedded devices.

How an attack unfolds

An attacker crafts a UDF filesystem containing a symlink with an incomplete pathComponent header, mounts the image on a vulnerable kernel, and triggers symlink resolution to force the out-of-bounds read.

How to fix it

Apply the upstream kernel patch that adds length validation before accessing the pathComponent header; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm the presence of the input-length check in udf_pc_to_char() or verify the kernel version contains the fix commit; test with a crafted malformed symlink image.

Typical attack path

1. Create malicious UDF image with truncated pathComponent header in symlink
2. Deliver image to target via removable media, network share, or archive
3. Victim mounts the image or accesses the symlink
4. Kernel calls udf_symlink_filler() then udf_pc_to_char() on partial header
5. Out-of-bounds read occurs, exposing adjacent kernel memory

How to detect it

Review kernel logs for oops or panic entries referencing udf_pc_to_char or udf_symlink_filler; inspect mount and file-access logs around the time a suspicious UDF image is introduced.

What your security team should do

• Prioritize patching kernel on any system that mounts UDF volumes from untrusted sources
• Disable UDF filesystem support via module blacklist if not required
• Monitor for new kernel releases and schedule rapid deployment given the 37-day window since publication