CVE-2026-53369

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable `udf_read_tagged()` runs in kernel UDF metadata parsing reached via the `mount()`/`fsopen` path through `get_tree_bdev()` → `udf_fill_super()` and on later VFS inode lookups via `udf_read_ptagged()`. UDF is a block-device filesystem (DVD/USB/loop), not a wire protocol parser like nfsd or ksmbd; exploitation requires supplying a crafted image on a block device the kernel reads.

AC:LAttack complexity, low

Triggering the flaw is reliable: set `descCRCLength` so `descCRCLength + sizeof(struct tag)` exceeds the block size, recompute the trivial 8-bit `tagChecksum` over the 16-byte tag header, and the descriptor is accepted with arbitrary body content. No races or victim-specific memory layout are required.

PR:NPrivileges required, none

No target-system account is needed in the highest-impact scenario: a crafted UDF USB/DVD inserted into a kiosk, automotive head unit, or shared workstation is auto-mounted by udev/systemd as root. An unprivileged local attacker with user-namespace `CAP_SYS_ADMIN` can also mount a loop-backed crafted image (PR:L), but PR:N is chosen when uncertain.

UI:NUser interaction, none

When the attacker mounts their own crafted image (including via user namespace) or relies on automated mounting of removable media, no additional victim interaction beyond the attacker's own action is required. UI:R applies only to purely victim-initiated manual mounts.

S:UScope, unchanged

Exploitation stays within kernel host context parsing attacker-controlled filesystem metadata; it does not cross a VM, container, or IOMMU security boundary by itself, though it can enable local privilege escalation.

C:HConfidentiality impact, high

Bypassing descriptor CRC lets an attacker forge partition descriptors, logical volume descriptors, and file entries that would otherwise be rejected, directing `udf_get_pblock()`/`sb_bread()` to attacker-chosen locations on the backing block device and feeding corrupted metadata into later parsers. Similar UDF crafted-image bugs have produced kernel out-of-bounds reads; this integrity bypass is a plausible path to arbitrary kernel memory disclosure.

I:HIntegrity impact, high

Forged descriptors can supply malicious partition maps, extent locations, and inode allocation metadata that downstream UDF code treats as validated, enabling arbitrary block-device writes on read-write mounts and heap/metadata corruption exploitable for control-flow hijacking. When uncertain between limited and arbitrary impact, the higher severity applies.

A:HAvailability impact, high

Accepting CRC-bypassed malformed descriptors during mount or inode load can cause kernel oops/panic through inconsistent metadata in allocation, directory, and extent handling paths. Even when full exploitation is not achieved, corrupted descriptor processing commonly crashes the kernel.