Linux Kernel UDF Sparing Table Length Validation Bypass

CVE-2026-64322 is a memory validation flaw in the Linux kernel's UDF filesystem driver where the sparing table length is incorrectly validated as a byte count rather than an entry count. The vulnerability exists in udf_load_sparable_map(), which checks if the table fits within a block using byte-level arithmetic, but then iterates through the table as an array of 8-byte sparingEntry structures. This mismatch allows an attacker to supply a malformed UDF filesystem image with an oversized sparing table that passes validation but causes out-of-bounds memory access during parsing. Systems mounting untrusted UDF media—including USB drives, optical discs, or container images—are affected, potentially leading to kernel information disclosure, denial of service, or privilege escalation depending on the memory accessed.

While CVE-2026-64322 lacks mapped MITRE ATT&CK techniques and no Casky skills directly correlate to this specific vulnerability, practitioners using Casky.ai would benefit from extended reasoning analysis around Memory Safety (CWE-119 class issues) and Filesystem Handling patterns. Claude's reasoning capability can identify the semantic gap between validation logic and iteration logic—a pattern common in Exploitation (T1203) and Local Privilege Escalation (T1134) attack chains. A practitioner reviewing kernel security findings would see this surface as improper input validation during filesystem mount operations, correlating to Defense Evasion (T1036) techniques where malformed structures bypass safety checks. Detection would involve monitoring for UDF mount attempts with anomalous table structures and kernel memory access violations.