linux-kernel - [BUG] fs/udf: potential metadata validation issue during mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4cf43912.47d06.19aee4f5fe9.Coremail.xujiakai2025@iscas.ac.cn>
Date: Fri, 5 Dec 2025 19:39:30 +0800 (GMT+08:00)
From: "Jiakai Xu" <xujiakai2025@...as.ac.cn>
To: linux-kernel@...r.kernel.org, "Jan Kara" <jack@...e.com>
Cc: 2200013188@....pku.edu.cn
Subject: [BUG] fs/udf: potential metadata validation issue during mount

Hi Jan,

I have identified a potential issue in the UDF filesystem
while fuzz-testing the mainline kernel (v6.18).

It appears that the UDF mount code may perform
insufficient validation of user-provided filesystem data.
When the image contains malformed or random data, the
mount can succeed, but internal UDF metadata structures
may become inconsistent.

Subsequent file extension operations (e.g., truncate())
trigger the following warning in __udf_add_aext():

WARNING: CPU: ... at fs/udf/inode.c:2083 __udf_add_aext()

While this warning does not panic the kernel, it is
unclear whether the corrupted metadata could later lead
to serious memory-safety issues.

I may be misinterpreting the behavior, but if this
represents a potential bug, I would be glad to assist
with further analysis or a fix.

Detailed analysis, reproducer, kernel configuration,
and logs are available here:
https://github.com/j1akai/temp/tree/main/20251205

Best regards,
Jiakai