---
id: CVE-2026-93055
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  UDF symlink pathComponent header OOB read


  udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent
  header.


  Validate that enough input remains for …
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  UDF symlink pathComponent header OOB read


  udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent
  header.


  Validate that enough input remains for …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d9f49c8b55debf1512f912077b6c759cc8b6d2e0
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    48b2a74317e15f93983c74a5a07245bc94a00d39
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f44f5f795f1a56249821a05183347ea025855e31
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    57371e743398e0d485f0f7beede1ade41f812324
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    ee264227b656218bc1b257d8e4f83467f5f17723
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8da8fd3df9fc14cf79ca3a3978d27ba067985111
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b21cb958292ee1e02eb305ff9de09f2f7edd551a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d23eb7380d1594cda31a5dc8487dd2a5c8def8c7
  - Linux 2.6.12
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:59.060'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93055'
references:
  - url: 'https://git.kernel.org/stable/c/48b2a74317e15f93983c74a5a07245bc94a00d39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/57371e743398e0d485f0f7beede1ade41f812324'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8da8fd3df9fc14cf79ca3a3978d27ba067985111'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b21cb958292ee1e02eb305ff9de09f2f7edd551a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d23eb7380d1594cda31a5dc8487dd2a5c8def8c7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d9f49c8b55debf1512f912077b6c759cc8b6d2e0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee264227b656218bc1b257d8e4f83467f5f17723'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f44f5f795f1a56249821a05183347ea025855e31'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.769Z'
epss: 0.00176
epssPercentile: 0.07439
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

UDF symlink pathComponent header OOB read

udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header.

Validate that enough input remains for a complete pathComponent header
before accessing it. Reject malformed symlink data that would otherwise
make udf_pc_to_char() perform an out-of-bounds read.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.