{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  udf: validate VAT header length against the VAT inode size  udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:  \tmap-\u003es_type_specific.s_virtual.s_start_offset = \t\tle16_to_cpu(vat20-\u003elengthHeader); \tmap-\u003es_type_specific.s_virtual.s_num_entries = \t\t(sbi-\u003es_vat_inode-\u003ei_size - \t\t\tmap-\u003es_type_specific.s_virtual.s_start_offset) \u003e\u003e 2;  lengthHeader is a fully attacker-controlled 16-bit value.  If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the \"block \u003e s_num_entries\" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads  \t((__le32 *)(iinfo-\u003ei_data + s_start_offset))[block]  so a large s_start_offset indexes past the inode's in-ICB data.  Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read.  Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.",
  "id": "DEBIAN-CVE-2026-64323",
  "modified": "2026-09-14T16:47:38.217106958Z",
  "published": "2026-07-25T10:17:13.790Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64323"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64323"
  ]
}