PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45991 Linux CVE debrief

A heap out-of-bounds write vulnerability exists in the Linux kernel's UDF filesystem driver. The flaw occurs in `handle_partition_descriptor()` when mounting crafted UDF images containing repeated partition descriptors. The function deduplicates entries by partition number, but appended slots fail to record the partition number (`partnum`). This causes duplicate partition descriptors to be appended repeatedly while `num_part_descs` continues growing. When the table reaches capacity, the growth path sizes allocation from `partnum` rather than the append count. If `partnum` aligns to `PART_DESC_ALLOC_STEP`, `ALIGN(partnum, step)` may retain the old capacity, causing subsequent appends to write beyond the allocated buffer. The fix stores `partnum` in appended slots and sizes growth from the next append count to align deduplication with capacity tracking.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Linux system administrators, kernel maintainers, and security teams managing systems that process UDF filesystem images, particularly those allowing user-controlled media mounting or handling untrusted optical media images.

Technical summary

The UDF (Universal Disk Format) driver in the Linux kernel contains a heap buffer overflow vulnerability triggered during partition descriptor parsing. The `handle_partition_descriptor()` function manages a dynamic array `part_descs_loc[]` for partition descriptors. While the function implements deduplication logic based on partition numbers, the implementation fails to store the partition number in newly appended slots. This bookkeeping error allows duplicate descriptors to accumulate unchecked. The capacity growth calculation uses `ALIGN(partnum, PART_DESC_ALLOC_STEP)` rather than the actual slot count, creating a mismatch when `partnum` values align with allocation boundaries. Under these conditions, the array fails to expand while inserts continue, resulting in writes past the heap allocation boundary. The resolution ensures partition numbers are recorded in all slots and capacity calculations use the append count for consistent tracking.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable tree commits when available for your distribution
  • Restrict mounting of untrusted UDF filesystem images
  • Monitor kernel security advisories for stable backports
  • Review systems allowing user-controlled filesystem mounting

Evidence notes

Vulnerability disclosed via Linux kernel stable tree commits on 2026-05-27. The issue affects UDF filesystem mounting operations. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45991 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45991

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45991 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45991

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/058b451b1039f056d1362c4fec2229e522366ab0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/08841b06fa64d8edbd1a21ca6e613420c90cc4b8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/08fa5d818e5bf53c7ca234d88ba334f32004e9b6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b5597bb83fc37b5b5da74a4453fa920b932cf39a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.