In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the guard while logicalBlockNum + offset + count points past the partition, which later indexes past the space bitmap array. A single ftruncate(2) on a file backed by such an extent reliably panics the kernel. This is a local availability issue. On desktop systems where UDisks/polkit allows the active user to mount removable UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply the crafted filesystem and trigger the panic by truncating a writable file on it. Systems that require root or CAP_SYS_ADMIN to mount the image have a higher prerequisite. No confidentiality or integrity impact is claimed: the reproduced primitive is an out-of-bounds read of a bitmap pointer slot
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64324 is a critical memory safety vulnerability in the Linux kernel's UDF (Universal Disk Format) filesystem implementation. The vulnerability exists in the udf_free_blocks() function, which fails to properly validate free block extents against partition boundaries. Specifically, the function checks logical block numbers and counts but incorrectly drops the extent offset from the final boundary calculation, allowing crafted extents to pass validation checks while actually pointing past the partition's allocated space. This affects any system running a vulnerable Linux kernel that processes UDF filesystems, particularly those handling untrusted disk images or mount operations. The impact is severe—a single ftruncate(2) system call on a specially crafted file can reliably trigger a kernel panic, enabling denial-of-service attacks or potential privilege escalation depending on the attacker's capability to control filesystem metadata.
While Casky's current skill mapping shows zero matching techniques for this CVE, practitioners using Casky's Claude-powered analysis would benefit from investigating resource exhaustion and kernel memory access patterns. This vulnerability exemplifies Defense Evasion (ATT&CK T1211 - Exploitation for Defense Evasion) through malformed input validation, and Resource Hijacking (T1657) via out-of-bounds memory access. In practice, detection would focus on monitoring for unusual filesystem mounting patterns, kernel oops/panic events correlated with ftruncate operations on UDF volumes, and system calls that attempt to manipulate extents with suspicious offset values. Security practitioners should prioritize kernel patching, UDF filesystem restriction policies, and filesystem input validation hardening as immediate mitigation strategies.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64324. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation