U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2026-53369 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://git.kernel.org/stable/c/1873eb81c65d3f849418d7386baa39c439c9fc38 kernel.org
https://git.kernel.org/stable/c/31605bbe94557bff721eaf041001169d44ac6f98 kernel.org
https://git.kernel.org/stable/c/3dede76d525919bb966f9213e131af685de5ff99 kernel.org
https://git.kernel.org/stable/c/50dfaf4a027742b4fcdc3e9305e7199ece9bc6a6 kernel.org
https://git.kernel.org/stable/c/55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 kernel.org
https://git.kernel.org/stable/c/7d1b6adbf90df6c8941090d5646fbeca25ba9770 kernel.org
https://git.kernel.org/stable/c/832ab4a882dc9b3c0155490d9993642ef545fd22 kernel.org
https://git.kernel.org/stable/c/fdb26e628d2a211a23815d375bd33bdf863344e2 kernel.org

Weakness Enumeration

CWE-ID CWE Name Source

Change History

1 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2026-53369
NVD Published Date:
07/19/2026
NVD Last Modified:
07/19/2026
Source:
kernel.org