FKIE_CVE-2026-46303

Vulnerability from fkie_nvd - Published: 2026-06-08 17:16 - Updated: 2026-07-23 08:10
Severity
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Summary
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfcPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4bePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fePatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 7.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/isofs/rock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8356fb821016797f5677cbeee5ddc0d32a95b4be",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "d582e12378bc1637f337622feef762f53c43fd57",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "c9b37c8b73f6368e4750e5ccb0632c380b43c6e5",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "22b36fa081f38ab397c7697f9d539211b51a0cfc",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "e69da8eeab74b4f4505024c38a17bce060fe7df8",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "ef048470c90bc8c1b8318bb2ce329da9ef64b9fe",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "lessThan": "a36d990f591320e9dd379ab30063ebfe91d47e1f",
              "status": "affected",
              "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "212c4d33ca83e2144064fe9c2911607fbed5386f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "96e44adce250199ec9b2b928be66365779ff1b59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1fe5620fcd6c2f0a4a927ee10c8e53196da392f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fbce0d7dc8965c9fb8d411862040239d4a768c71",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8190393a88f2b0321263a54f2a9eb5a2aa43be7e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "486aa789eadcf44ed87f972b209299c516454693",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b6d20edb6e7cedb4eedb9e0193d20dd488ebae84",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.33",
              "status": "affected",
              "version": "2.6.32.66",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.67",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.107",
              "versionType": "semver"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.64",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.36",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.28",
              "versionType": "semver"
            },
            {
              "lessThan": "3.18",
              "status": "affected",
              "version": "3.17.8",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/isofs/rock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE79466A-8004-4545-9F2B-9AE61FF25E49",
              "versionEndExcluding": "2.6.33",
              "versionStartIncluding": "2.6.32.66",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E339763B-0FFB-4F77-925F-B75B0574196F",
              "versionEndExcluding": "3.3",
              "versionStartIncluding": "3.2.67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D756A04-79C7-4DB6-9A50-9E8E5B2757F2",
              "versionEndExcluding": "3.5",
              "versionStartIncluding": "3.4.107",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B3FB946-FA61-41D1-8295-A7D889D63B3E",
              "versionEndExcluding": "3.11",
              "versionStartIncluding": "3.10.64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "881E140A-B761-4577-B10F-CF48988916FB",
              "versionEndExcluding": "3.13",
              "versionStartIncluding": "3.12.36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA5F1F71-BA36-4EC2-A59D-E285C9983115",
              "versionEndExcluding": "3.15",
              "versionStartIncluding": "3.14.28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1743B4F8-1859-415F-9EB5-A33C53ABCD2E",
              "versionEndExcluding": "3.18",
              "versionStartIncluding": "3.17.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C5C08E2-8006-4964-BA58-B339247E1301",
              "versionEndExcluding": "5.10.258",
              "versionStartIncluding": "3.18.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4",
              "versionEndExcluding": "5.15.209",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA",
              "versionEndExcluding": "6.1.175",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D",
              "versionEndExcluding": "6.6.140",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4",
              "versionEndExcluding": "6.12.88",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
              "versionEndExcluding": "6.18.30",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
              "versionEndExcluding": "7.0.7",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate Rock Ridge CE continuation extent against volume size\n\nrock_continue() reads rs-\u003econt_extent verbatim from the Rock Ridge CE\nrecord and passes it to sb_bread() without checking that the block\nnumber is within the mounted ISO 9660 volume.  commit e595447e177b\n(\"[PATCH] rock.c: handle corrupted directories\") added cont_offset\nand cont_size rejection for the CE continuation but did not validate\nthe extent block number itself.  commit f54e18f1b831 (\"isofs: Fix\ninfinite looping over CE entries\") later capped the CE chain length\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.\n\nWith a crafted ISO mounted via udisks2 (desktop optical auto-mount)\nor via CAP_SYS_ADMIN mount, rs-\u003econt_extent can therefore point at\nan out-of-range block or at blocks belonging to an adjacent\nfilesystem on the same block device.  sb_bread() on an out-of-range\nblock returns NULL cleanly via the block layer EIO path, so there\nis no memory-safety violation.  For in-range reads of adjacent-\nfilesystem data, the CE buffer is parsed as Rock Ridge records and\nonly the text of SL sub-records reaches userspace through\nreadlink(), which makes the info-leak channel narrow and difficult\nto exploit; still, rejecting the malformed CE outright matches the\nrejection shape already present in the same function for\ncont_offset and cont_size.\n\nAdd an ISOFS_SB(sb)-\u003es_nzones bounds check to rock_continue() next\nto the existing offset/size rejection, printing the same\ncorrupted-directory-entry notice."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nisofs: validar la extensi\u00f3n de continuaci\u00f3n Rock Ridge CE contra el tama\u00f1o del volumen\n\nrock_continue() lee rs-\u003econt_extent textualmente del registro Rock Ridge CE y lo pasa a sb_bread() sin verificar que el n\u00famero de bloque est\u00e9 dentro del volumen ISO 9660 montado. El commit e595447e177b (\u0027[PATCH] rock.c: handle corrupted directories\u0027) a\u00f1adi\u00f3 el rechazo de cont_offset y cont_size para la continuaci\u00f3n CE pero no valid\u00f3 el n\u00famero de bloque de la extensi\u00f3n en s\u00ed. El commit f54e18f1b831 (\u0027isofs: Fix infinite looping over CE entries\u0027) m\u00e1s tarde limit\u00f3 la longitud de la cadena CE a RR_MAX_CE_ENTRIES = 32 pero de nuevo dej\u00f3 el n\u00famero de bloque sin verificar.\n\nCon un ISO manipulado montado v\u00eda udisks2 (montaje autom\u00e1tico \u00f3ptico de escritorio) o v\u00eda montaje CAP_SYS_ADMIN, rs-\u003econt_extent puede, por lo tanto, apuntar a un bloque fuera de rango o a bloques pertenecientes a un sistema de archivos adyacente en el mismo dispositivo de bloques. sb_bread() en un bloque fuera de rango devuelve NULL limpiamente v\u00eda la ruta EIO de la capa de bloques, por lo que no hay violaci\u00f3n de seguridad de memoria. Para lecturas dentro de rango de datos de sistemas de archivos adyacentes, el b\u00fafer CE se analiza como registros Rock Ridge y solo el texto de los subregistros SL llega al espacio de usuario a trav\u00e9s de readlink(), lo que hace que el canal de fuga de informaci\u00f3n sea estrecho y dif\u00edcil de exploit; a\u00fan as\u00ed, rechazar el CE malformado directamente coincide con la forma de rechazo ya presente en la misma funci\u00f3n para cont_offset y cont_size.\n\nA\u00f1adir una verificaci\u00f3n de l\u00edmites ISOFS_SB(sb)-\u003es_nzones a rock_continue() junto al rechazo existente de offset/size, imprimiendo el mismo aviso de entrada de directorio corrupta."
    }
  ],
  "id": "CVE-2026-46303",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-08T17:16:48.853",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.