CVE-2026-46303

{"id": "CVE-2026-46303", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "8356fb821016797f5677cbeee5ddc0d32a95b4be", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "d582e12378bc1637f337622feef762f53c43fd57", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "c9b37c8b73f6368e4750e5ccb0632c380b43c6e5", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "22b36fa081f38ab397c7697f9d539211b51a0cfc", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "e69da8eeab74b4f4505024c38a17bce060fe7df8", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "ef048470c90bc8c1b8318bb2ce329da9ef64b9fe", "versionType": "git"}, {"status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "a36d990f591320e9dd379ab30063ebfe91d47e1f", "versionType": "git"}, {"status": "affected", "version": "08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56", "versionType": "git"}, {"status": "affected", "version": "212c4d33ca83e2144064fe9c2911607fbed5386f", "versionType": "git"}, {"status": "affected", "version": "96e44adce250199ec9b2b928be66365779ff1b59", "versionType": "git"}, {"status": "affected", "version": "1fe5620fcd6c2f0a4a927ee10c8e53196da392f3", "versionType": "git"}, {"status": "affected", "version": "fbce0d7dc8965c9fb8d411862040239d4a768c71", "versionType": "git"}, {"status": "affected", "version": "8190393a88f2b0321263a54f2a9eb5a2aa43be7e", "versionType": "git"}, {"status": "affected", "version": "486aa789eadcf44ed87f972b209299c516454693", "versionType": "git"}, {"status": "affected", "version": "b6d20edb6e7cedb4eedb9e0193d20dd488ebae84", "versionType": "git"}, {"status": "affected", "version": "2.6.32.66", "lessThan": "2.6.33", "versionType": "semver"}, {"status": "affected", "version": "3.2.67", "lessThan": "3.3", "versionType": "semver"}, {"status": "affected", "version": "3.4.107", "lessThan": "3.5", "versionType": "semver"}, {"status": "affected", "version": "3.10.64", "lessThan": "3.11", "versionType": "semver"}, {"status": "affected", "version": "3.12.36", "lessThan": "3.13", "versionType": "semver"}, {"status": "affected", "version": "3.14.28", "lessThan": "3.15", "versionType": "semver"}, {"status": "affected", "version": "3.17.8", "lessThan": "3.18", "versionType": "semver"}, {"status": "affected", "version": "3.18.2", "lessThan": "3.19", "versionType": "semver"}], "programFiles": ["fs/isofs/rock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"status": "unaffected", "version": "0", "lessThan": "3.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.88", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.30", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.7", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/isofs/rock.c"], "defaultStatus": "affected"}]}], "published": "2026-06-08T17:16:48.853", "references": [{"url": "https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate Rock Ridge CE continuation extent against volume size\n\nrock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE\nrecord and passes it to sb_bread() without checking that the block\nnumber is within the mounted ISO 9660 volume. commit e595447e177b\n(\"[PATCH] rock.c: handle corrupted directories\") added cont_offset\nand cont_size rejection for the CE continuation but did not validate\nthe extent block number itself. commit f54e18f1b831 (\"isofs: Fix\ninfinite looping over CE entries\") later capped the CE chain length\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.\n\nWith a crafted ISO mounted via udisks2 (desktop optical auto-mount)\nor via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at\nan out-of-range block or at blocks belonging to an adjacent\nfilesystem on the same block device. sb_bread() on an out-of-range\nblock returns NULL cleanly via the block layer EIO path, so there\nis no memory-safety violation. For in-range reads of adjacent-\nfilesystem data, the CE buffer is parsed as Rock Ridge records and\nonly the text of SL sub-records reaches userspace through\nreadlink(), which makes the info-leak channel narrow and difficult\nto exploit; still, rejecting the malformed CE outright matches the\nrejection shape already present in the same function for\ncont_offset and cont_size.\n\nAdd an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next\nto the existing offset/size rejection, printing the same\ncorrupted-directory-entry notice."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nisofs: validar la extensi\u00f3n de continuaci\u00f3n Rock Ridge CE contra el tama\u00f1o del volumen\n\nrock_continue() lee rs->cont_extent textualmente del registro Rock Ridge CE y lo pasa a sb_bread() sin verificar que el n\u00famero de bloque est\u00e9 dentro del volumen ISO 9660 montado. El commit e595447e177b ('[PATCH] rock.c: handle corrupted directories') a\u00f1adi\u00f3 el rechazo de cont_offset y cont_size para la continuaci\u00f3n CE pero no valid\u00f3 el n\u00famero de bloque de la extensi\u00f3n en s\u00ed. El commit f54e18f1b831 ('isofs: Fix infinite looping over CE entries') m\u00e1s tarde limit\u00f3 la longitud de la cadena CE a RR_MAX_CE_ENTRIES = 32 pero de nuevo dej\u00f3 el n\u00famero de bloque sin verificar.\n\nCon un ISO manipulado montado v\u00eda udisks2 (montaje autom\u00e1tico \u00f3ptico de escritorio) o v\u00eda montaje CAP_SYS_ADMIN, rs->cont_extent puede, por lo tanto, apuntar a un bloque fuera de rango o a bloques pertenecientes a un sistema de archivos adyacente en el mismo dispositivo de bloques. sb_bread() en un bloque fuera de rango devuelve NULL limpiamente v\u00eda la ruta EIO de la capa de bloques, por lo que no hay violaci\u00f3n de seguridad de memoria. Para lecturas dentro de rango de datos de sistemas de archivos adyacentes, el b\u00fafer CE se analiza como registros Rock Ridge y solo el texto de los subregistros SL llega al espacio de usuario a trav\u00e9s de readlink(), lo que hace que el canal de fuga de informaci\u00f3n sea estrecho y dif\u00edcil de exploit; a\u00fan as\u00ed, rechazar el CE malformado directamente coincide con la forma de rechazo ya presente en la misma funci\u00f3n para cont_offset y cont_size.\n\nA\u00f1adir una verificaci\u00f3n de l\u00edmites ISOFS_SB(sb)->s_nzones a rock_continue() junto al rechazo existente de offset/size, imprimiendo el mismo aviso de entrada de directorio corrupta."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE79466A-8004-4545-9F2B-9AE61FF25E49", "versionEndExcluding": "2.6.33", "versionStartIncluding": "2.6.32.66"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E339763B-0FFB-4F77-925F-B75B0574196F", "versionEndExcluding": "3.3", "versionStartIncluding": "3.2.67"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D756A04-79C7-4DB6-9A50-9E8E5B2757F2", "versionEndExcluding": "3.5", "versionStartIncluding": "3.4.107"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B3FB946-FA61-41D1-8295-A7D889D63B3E", "versionEndExcluding": "3.11", "versionStartIncluding": "3.10.64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "881E140A-B761-4577-B10F-CF48988916FB", "versionEndExcluding": "3.13", "versionStartIncluding": "3.12.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA5F1F71-BA36-4EC2-A59D-E285C9983115", "versionEndExcluding": "3.15", "versionStartIncluding": "3.14.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1743B4F8-1859-415F-9EB5-A33C53ABCD2E", "versionEndExcluding": "3.18", "versionStartIncluding": "3.17.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C5C08E2-8006-4964-BA58-B339247E1301", "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.18.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}