In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VA
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64323 affects the Linux kernel's UDF (Universal Disk Format) filesystem implementation, specifically in how it processes Virtual Allocation Table (VAT) headers. The vulnerability exists in the udf_load_vat() function, which fails to validate the VAT header length value from the on-disk VAT 2.0 header against the actual VAT inode size. An attacker can craft a malicious UDF filesystem image with an oversized lengthHeader value that exceeds the VAT inode size, potentially causing integer underflow or out-of-bounds memory access when calculating s_num_entries. This affects any system mounting untrusted or malicious UDF filesystems, including embedded devices, storage appliances, and endpoints that process removable media or network-mounted volumes.
While Casky.ai currently shows zero matching skills for this specific CVE, practitioners leveraging Claude's extended reasoning capabilities would benefit from mapping this vulnerability to kernel hardening and input validation detection patterns. The underlying attack pattern—trusting attacker-controlled filesystem metadata without bounds checking—mirrors broader CWE-190 (Integer Overflow/Underflow) and CWE-120 (Buffer Copy Without Bounds Checking) weaknesses. Detection would focus on kernel audit logs showing failed filesystem mount operations, memory protection faults, or suspicious filesystem parsing behavior. Security practitioners should monitor for filesystem-based attack vectors (T1566: Phishing with Attachments, T1204: User Execution of Malicious Files) when users mount external media, and implement validation controls that verify filesystem metadata consistency before kernel processing.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64323. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation