CVE-2026-46303isofs: validate Rock Ridge CE continuation extent against volume size
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice.
- CVSS
- 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f54e18f1b831c92f6512d2eedb224cd63d607d3d before 8356fb821016797f5677cbeee5ddc0d32a95b4be; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before d582e12378bc1637f337622feef762f53c43fd57; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before c9b37c8b73f6368e4750e5ccb0632c380b43c6e5; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before 22b36fa081f38ab397c7697f9d539211b51a0cfc; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before e69da8eeab74b4f4505024c38a17bce060fe7df8; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before ef048470c90bc8c1b8318bb2ce329da9ef64b9fe; from f54e18f1b831c92f6512d2eedb224cd63d607d3d before a36d990f591320e9dd379ab30063ebfe91d47e1f; and 16 more ranges | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.32.66 before 2.6.33; from 3.2.67 before 3.3; from 3.4.107 before 3.5; from 3.10.64 before 3.11; from 3.12.36 before 3.13; from 3.14.28 before 3.15; from 3.17.8 before 3.18; from 3.18.2 before 5.10.258; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4bepatch
- https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57patch
- https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9patch
- https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5patch
- https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfcpatch
- https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8patch
- https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fepatch
- https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1fpatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.