CVE-2026-45991

Estado: ModificadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

udf: fix partition descriptor append bookkeeping

Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[].

handle_partition_descriptor() deduplicates entries by partition number, but appended slots never record partnum. As a result duplicate Partition Descriptors are appended repeatedly and num_part_descs keeps growing.

Once the table is full, the growth path still sizes the allocation from partnum even though inserts are indexed by num_part_descs. If partnum is already aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep the old capacity and the next append writes past the end of the table.

Leer descripción completaMostrar menos

Store partnum in the appended slot and size growth from the next append count so deduplication and capacity tracking follow the same model.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.17%
Percentil entre todas las CVEs puntuadas: 6
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1059 Command and Scripting Interpreterexecution75 %

Acceso local (AV:L) sin interacción. Heap overflow en kernel UDF permite escalada de privilegios (T1068) y potencial ejecución de código (T1059) con permisos elevados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-787

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-45991",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "ad3c0c4400686f6f37b382aaa48fac2b9aefccbe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "68013a9bd4c01acd42073715f00e1a1992f089ee",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "e8474cfbac9ada2cdaa4eaedec22aadfa0f58559",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "058b451b1039f056d1362c4fec2229e522366ab0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "b5597bb83fc37b5b5da74a4453fa920b932cf39a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "08fa5d818e5bf53c7ca234d88ba334f32004e9b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "lessThan": "08841b06fa64d8edbd1a21ca6e613420c90cc4b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f401f160a9c7a1ff84ba3cb9b2f636d1f5cfb6b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.18.7",
              "lessThan": "4.19",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/udf/super.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/udf/super.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-27T14:17:16.643",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/058b451b1039f056d1362c4fec2229e522366ab0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/08841b06fa64d8edbd1a21ca6e613420c90cc4b8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/08fa5d818e5bf53c7ca234d88ba334f32004e9b6",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/68013a9bd4c01acd42073715f00e1a1992f089ee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ad3c0c4400686f6f37b382aaa48fac2b9aefccbe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5597bb83fc37b5b5da74a4453fa920b932cf39a",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e8474cfbac9ada2cdaa4eaedec22aadfa0f58559",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: fix partition descriptor append bookkeeping\n\nMounting a crafted UDF image with repeated partition descriptors can\ntrigger a heap out-of-bounds write in part_descs_loc[].\n\nhandle_partition_descriptor() deduplicates entries by partition number,\nbut appended slots never record partnum. As a result duplicate\nPartition Descriptors are appended repeatedly and num_part_descs keeps\ngrowing.\n\nOnce the table is full, the growth path still sizes the allocation from\npartnum even though inserts are indexed by num_part_descs. If partnum is\nalready aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep\nthe old capacity and the next append writes past the end of the table.\n\nStore partnum in the appended slot and size growth from the next append\ncount so deduplication and capacity tracking follow the same model."
    }
  ],
  "lastModified": "2026-06-19T13:16:31.053",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5BDA993-EF76-4D54-84B2-73CDF4E1B72C",
              "versionEndExcluding": "4.19",
              "versionStartIncluding": "4.18.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03E02558-93BE-47E0-82D4-3BE2135EC2BF",
              "versionEndExcluding": "6.6.140",
              "versionStartIncluding": "4.19.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4",
              "versionEndExcluding": "6.12.88",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFAD87B2-77CB-48FF-B0F8-D6A539C24301",
              "versionEndExcluding": "7.0.4",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFDAD450-8799-4C2D-80CE-2AA45DEC35CE"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "490A26B2-349C-4C71-AD40-2EA486A34DD1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A60AAA7-F86C-4D3E-933D-0ECEFE637CEF"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79225B06-DC8B-4622-94DF-797D7B1588D8"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "344A395A-4EA9-4A70-B52B-622DFC91B2F5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77A82DDA-F9EB-4146-A264-F144821F5B48"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50D37BFA-0EDF-4061-AE49-2547A31AF500"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.19:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C76524C2-3C99-42A8-B110-C3B886DEAFA5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}