Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-46303

isofs: validate Rock Ridge CE continuation extent against volume size

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.6.33, 3.3, 3.5, 3.11, 3.13, and 10 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in 8356fb821016797f5677cbeee5ddc0d32a95b4be; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in d582e12378bc1637f337622feef762f53c43fd57; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in c9b37c8b73f6368e4750e5ccb0632c380b43c6e5; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in 22b36fa081f38ab397c7697f9d539211b51a0cfc; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in e69da8eeab74b4f4505024c38a17bce060fe7df8; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in ef048470c90bc8c1b8318bb2ce329da9ef64b9fe; From f54e18f1b831c92f6512d2eedb224cd63d607d3d · fixed in a36d990f591320e9dd379ab30063ebfe91d47e1f; From 2.6.32.66 · fixed in 2.6.33; From 3.2.67 · fixed in 3.3; From 3.4.107 · fixed in 3.5; From 3.10.64 · fixed in 3.11; From 3.12.36 · fixed in 3.13; From 3.14.28 · fixed in 3.15; From 3.17.8 · fixed in 3.18; From 3.18.2 · fixed in 3.19

  • Linux Linux

    3.19

  • KernelLinux

    From 3.19.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.88; From 6.13.0 · fixed in 6.18.30; From 6.19.0 · fixed in 7.0.7

References 8

git.kernel.org