{"id":"CVE-2026-45991","revision":"4b071408a1b74422ae49255dcb0ea37d","records":[{"revision":"4b071408a1b74422ae49255dcb0ea37d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45991","aliases":[],"title":"udf: fix partition descriptor append bookkeeping","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nudf: fix partition descriptor append bookkeeping\n\nMounting a crafted UDF image with repeated partition descriptors can\ntrigger a heap out-of-bounds write in part_descs_loc[].\n\nhandle_partition_descriptor() deduplicates entries by partition number,\nbut appended slots never record partnum. As a result duplicate\nPartition Descriptors are appended repeatedly and num_part_descs keeps\ngrowing.\n\nOnce the table is full, the growth path still sizes the allocation from\npartnum even though inserts are indexed by num_part_descs. If partnum is\nalready aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep\nthe old capacity and the next append writes past the end of the table.\n\nStore partnum in the appended slot and size growth from the next append\ncount so deduplication and capacity tracking follow the same model.","state":0,"publishedAt":"2026-05-27T12:55:43.449+00:00","modifiedAt":"2026-10-19T19:26:41.286+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/udf/super.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"ad3c0c4400686f6f37b382aaa48fac2b9aefccbe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"68013a9bd4c01acd42073715f00e1a1992f089ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"e8474cfbac9ada2cdaa4eaedec22aadfa0f58559\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"058b451b1039f056d1362c4fec2229e522366ab0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"b5597bb83fc37b5b5da74a4453fa920b932cf39a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"73df74544b55241dca5dd788523e6f5f10bd2b9b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"08fa5d818e5bf53c7ca234d88ba334f32004e9b6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee4af50ca94f58afc3532662779b9cf80bbe27c8\",\n                            \"lessThan\": \"08841b06fa64d8edbd1a21ca6e613420c90cc4b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7f401f160a9c7a1ff84ba3cb9b2f636d1f5cfb6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.18.7\",\n                            \"lessThan\": \"4.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/udf/super.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.259\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.140\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.88\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.4\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ad3c0c4400686f6f37b382aaa48fac2b9aefccbe","https://git.kernel.org/stable/c/68013a9bd4c01acd42073715f00e1a1992f089ee","https://git.kernel.org/stable/c/e8474cfbac9ada2cdaa4eaedec22aadfa0f58559","https://git.kernel.org/stable/c/058b451b1039f056d1362c4fec2229e522366ab0","https://git.kernel.org/stable/c/b5597bb83fc37b5b5da74a4453fa920b932cf39a","https://git.kernel.org/stable/c/73df74544b55241dca5dd788523e6f5f10bd2b9b","https://git.kernel.org/stable/c/08fa5d818e5bf53c7ca234d88ba334f32004e9b6","https://git.kernel.org/stable/c/08841b06fa64d8edbd1a21ca6e613420c90cc4b8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45991","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45991","identifiers":["CVE-2026-45991"]},"retained":false,"historicalAffected":[]}],"coverage":[]}