All vulnerabilities
CVE-2026-93828

Linux: exfat: fix handling of damaged volume in exfat_create_upcase_table()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in29723256fccf46e55c2a44bd6b8345bef7ba079bAlso 60ace93811609e4dd883e9de5fb4462ed834160a, 2cc0b612343638057ef321ce735201a7c2f52f25 and 1 moreCVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 29723256fccf46e55c2a44bd6b8345bef7ba079bLinuxCVE List
  • 60ace93811609e4dd883e9de5fb4462ed834160aLinuxCVE List
  • 2cc0b612343638057ef321ce735201a7c2f52f25LinuxCVE List
  • 20dd3185d13865214ff25b0bf7b931e8d73be1acLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix handling of damaged volume in exfat_create_upcase_table()

When the size of the upcase table is set to zero in the dentry for any reason(e.g. corrupted media or misbehaving device), an integer overflow causes the module to loop indefinitely.

If the size of the upcase table is read zero, do not attempt to load the table. Instead, fallback to loading the default upcase table. If the size of the upcase table is zero or no upcase table is found, raise exfat_fs_error() to mark the volume read-only.

Text from CVE List

Affected versions 10

  • Linuxaffected: 370e812b3ec190fa492c9fd5a80c38b086d105c0 before 29723256fccf46e55c2a44bd6b8345bef7ba079bCVE List
  • Linuxaffected: 370e812b3ec190fa492c9fd5a80c38b086d105c0 before 60ace93811609e4dd883e9de5fb4462ed834160aCVE List
  • Linuxaffected: 370e812b3ec190fa492c9fd5a80c38b086d105c0 before 2cc0b612343638057ef321ce735201a7c2f52f25CVE List
  • Linuxaffected: 370e812b3ec190fa492c9fd5a80c38b086d105c0 before 20dd3185d13865214ff25b0bf7b931e8d73be1acCVE List
  • Linuxaffected: 5.7CVE List
  • Linuxunaffected: all versions before 5.7CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4