Linux Linux Kernel Out-Of-Bounds Write Rated 7.8 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-45991

Key Details

CVE	CVE-2026-45991
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel and Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Classified as	CWE-787 (Out-of-bounds Write)
Exploitation prediction (EPSS)	0.17% probability of exploitation in the next 30 days (6% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Siemens

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Subsystems	Controllers & Field I/O, OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

udf: fix partition descriptor append bookkeeping

Mounting a crafted UDF image with repeated partition descriptors can

trigger a heap out-of-bounds write in part_descs_loc[].

handle_partition_descriptor() deduplicates entries by partition number,

but appended slots never record partnum. As a result duplicate

Partition Descriptors are appended repeatedly and num_part_descs keeps

growing.

Once the table is full, the growth path still sizes the allocation from

partnum even though inserts are indexed by num_part_descs. If partnum is

already aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep

the old capacity and the next append writes past the end of the table.

Store partnum in the appended slot and size growth from the next append

count so deduplication and capacity tracking follow the same model. (NVD)

Monitor Linux's and Siemens's web pages for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-45991
CVE	https://www.cve.org/CVERecord?id=CVE-2026-45991

Source

Reference

NVD

CVE