Skip to main content

Linux Kernel EUVDEUVD-2026-45439

| CVE-2026-53369 HIGH
2026-07-19 Linux GHSA-rqjm-p6mw-3jj9
Authentication Bypass Linux
High
Disputed · 8.4 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.3 HIGH

Local, low-complexity kernel parsing bug, but mounting untrusted media realistically needs local mount privilege (PR:L) and a user/automount action (UI:R); full triad impact from potential kernel memory corruption.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 18:00 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.4 (HIGH)
Patch available
Jul 19, 2026 - 11:02 EUVD
CVE Published
Jul 19, 2026 - 09:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 09:10 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

udf: reject descriptors with oversized CRC length

udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable.

Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.

AnalysisAI

Integrity-check bypass in the Linux kernel's UDF filesystem driver allows a crafted disk image to defeat descriptor CRC validation, leaving only a trivially-forgeable 8-bit tag checksum guarding descriptor parsing. Affecting the udf_read_tagged() path across kernels from 2.6.12 through 7.1 pre-patch, an attacker who can get a malicious UDF image mounted can smuggle corrupted on-disk descriptors past validation, enabling downstream memory corruption with high confidentiality, integrity, and availability impact (CVSS 8.4). No public exploit is identified at time of analysis, and EPSS is low (0.19%), consistent with a local-only, media-dependent attack surface.

Technical ContextAI

The vulnerability lives in the UDF (Universal Disk Format) filesystem implementation used for DVDs, Blu-ray, and packet-written optical/USB media. Each on-disk UDF structure carries a 'tag' header containing an 8-bit tag checksum plus a descCRCLength field describing how many bytes the 16-bit CRC covers. In udf_read_tagged(), the kernel skips CRC verification entirely whenever descCRCLength + sizeof(struct tag) exceeds the block size - a guard meant to avoid reading past the block. A malicious image sets descCRCLength to an oversized value so this branch is taken, and the descriptor is then accepted on the strength of only the 8-bit tag checksum, which is recomputable by anyone. The root-cause class is improper validation of an integrity-check value (aligns with CWE-354/CWE-1284), where a length field controls whether a security check runs. CPE data identifies the affected component as cpe:2.3:a:linux:linux, i.e., the mainline kernel; the fix rejects descriptors whose CRC length exceeds the block rather than silently trusting them.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1 (or your distribution's backport carrying the equivalent commit), referencing the kernel.org stable commits (e.g., https://git.kernel.org/stable/c/50dfaf4a027742b4fcdc3e9305e7199ece9bc6a6) and https://nvd.nist.gov/vuln/detail/CVE-2026-53369. Where patching lags, reduce exposure by preventing untrusted UDF media from being mounted: blacklist or unload the udf module (e.g., 'install udf /bin/true') on systems that never need optical/UDF media, which fully removes the attack surface but breaks legitimate DVD/UDF access; disable or restrict removable-media automounting in udisks2/desktop settings so images are not mounted without an administrator's explicit action, at the cost of user convenience; and on multi-user or kiosk hosts, restrict mount privileges to trusted operators. These controls trade functionality for safety and should be lifted once the patched kernel is deployed and rebooted.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45439 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy