CVE-2026-46303 - Vulnerability Details

- isofs: validate Rock Ridge CE continuation extent against volume size

Description

In the Linux kernel, the following vulnerability has been resolved:

isofs: validate Rock Ridge CE continuation extent against volume size

rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE
record and passes it to sb_bread() without checking that the block
number is within the mounted ISO 9660 volume. commit e595447e177b
("[PATCH] rock.c: handle corrupted directories") added cont_offset
and cont_size rejection for the CE continuation but did not validate
the extent block number itself. commit f54e18f1b831 ("isofs: Fix
infinite looping over CE entries") later capped the CE chain length
at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.

With a crafted ISO mounted via udisks2 (desktop optical auto-mount)
or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at
an out-of-range block or at blocks belonging to an adjacent
filesystem on the same block device. sb_bread() on an out-of-range
block returns NULL cleanly via the block layer EIO path, so there
is no memory-safety violation. For in-range reads of adjacent-
filesystem data, the CE buffer is parsed as Rock Ridge records and
only the text of SL sub-records reaches userspace through
readlink(), which makes the info-leak channel narrow and difficult
to exploit; still, rejecting the malformed CE outright matches the
rejection shape already present in the same function for
cont_offset and cont_size.

Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next
to the existing offset/size rejection, printing the same
corrupted-directory-entry notice.

Published: 2026-06-08

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< 8356fb821016797f5677cbeee5ddc0d32a95b4be
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< d582e12378bc1637f337622feef762f53c43fd57
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< c9b37c8b73f6368e4750e5ccb0632c380b43c6e5
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< 22b36fa081f38ab397c7697f9d539211b51a0cfc
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< e69da8eeab74b4f4505024c38a17bce060fe7df8
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< ef048470c90bc8c1b8318bb2ce329da9ef64b9fe
`f54e18f1b831c92f6512d2eedb224cd63d607d3d`	affected	< a36d990f591320e9dd379ab30063ebfe91d47e1f
`08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56`	affected	—
`212c4d33ca83e2144064fe9c2911607fbed5386f`	affected	—
`96e44adce250199ec9b2b928be66365779ff1b59`	affected	—
`1fe5620fcd6c2f0a4a927ee10c8e53196da392f3`	affected	—
`fbce0d7dc8965c9fb8d411862040239d4a768c71`	affected	—
`8190393a88f2b0321263a54f2a9eb5a2aa43be7e`	affected	—
`486aa789eadcf44ed87f972b209299c516454693`	affected	—
`b6d20edb6e7cedb4eedb9e0193d20dd488ebae84`	affected	—
`2.6.32.66`	affected	< 2.6.33
`3.2.67`	affected	< 3.3
`3.4.107`	affected	< 3.5
`3.10.64`	affected	< 3.11
`3.12.36`	affected	< 3.13
`3.14.28`	affected	< 3.15
`3.17.8`	affected	< 3.18
`3.18.2`	affected	< 3.19

Linux

affected

Version	Status	Constraints
`3.19`	affected	—
`0`	unaffected	< 3.19
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.140`	unaffected	≤ 6.6.*
`6.12.88`	unaffected	≤ 6.12.*
`6.18.30`	unaffected	≤ 6.18.*
`7.0.7`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,8356fb821016797f5677cbeee5ddc0d32a95b4be)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,d582e12378bc1637f3377cbeee5ddc0d32a95b4be)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,bf1bc673c587f5ef7e9c09b94aea7c5a7847d9)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,c9b37c8b73f6368e4750e5ccb0632c380b43c6e5)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,22b36fa081f38ab397c7697f9d539211b51a0cfc)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,e69da8eeab74b4f4505024c38a17bce060fe7df8)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,ef048470c90bc8c1b8318bb2ce329da9ef64b9fe)`	affected	code_commit	—
`[f54e18f1b831c92f6512d2eedb224cd63d607d3d,a36d990f591320e9dd379ab30063ebfe91d47e1f)`	affected	code_commit	—
`08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56`	affected	code_commit	—
`212c4d33ca83e2144064fe9c2911607fbed5386f`	affected	code_commit	—
`96e44adce250199ec9b2b928be66365779ff1b59`	affected	code_commit	—
`1fe5620fcd6c2f0a4a927ee10c8e53196da392f3`	affected	code_commit	—
`fbce0d7dc8965c9fb8d411862040239d4a768c71`	affected	code_commit	—
`8190393a88f2b0321263a54f2a9eb5a2aa43be7e`	affected	code_commit	—
`486aa789eadcf44ed87f972b209299c516454693`	affected	code_commit	—
`b6d20edb6e7cedb4eedb9e0193d20dd488ebae84`	affected	code_commit	—
`[2.6.32.66,2.6.33)`	affected	semver	—
`[3.2.67,3.3.0)`	affected	semver	—
`[3.4.107,3.5.0)`	affected	semver	—
`[3.10.64,3.11.0)`	affected	semver	—
`[3.12.36,3.13.0)`	affected	semver	—
`[3.14.28,3.15.0)`	affected	semver	—
`[3.17.8,3.18.0)`	affected	semver	—
`[3.18.2,3.19.0)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.19`	affected	semver	—
`[0,3.19.0)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.140,6.7.0)`	unaffected	semver	—
`[6.12.88,6.13.0)`	unaffected	semver	—
`[6.18.30,6.19.0)`	unaffected	semver	—
`[7.0.7,7.1.0)`	unaffected	semver	—
`[7.1-rc2,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00278.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc
https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be
https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f
https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9
https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5
https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57
https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8
https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe
https://lore.kernel.org/linux-cve-announce/2026060859-CVE-2026-46303-d951@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46303
https://www.cve.org/CVERecord?id=CVE-2026-46303

History

Wed, 24 Jun 2026 05:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-200

Wed, 24 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026060859-CVE-2026-46303-d951@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46303 https://www.cve.org/CVERecord?id=CVE-2026-46303
Metrics	threat_severity `None`	threat_severity `Moderate`

Sun, 14 Jun 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-200

Sun, 14 Jun 2026 07:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-200

Sun, 14 Jun 2026 05:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}`

Mon, 08 Jun 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-200

Mon, 08 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice.
Title		isofs: validate Rock Ridge CE continuation extent against volume size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9 https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5 https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57 https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8 https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-08T15:46:30.642Z

Updated: 2026-06-14T18:07:47.782Z

Reserved: 2026-05-13T15:03:33.111Z

Link: CVE-2026-46303

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-06-08T17:16:48.853

Modified: 2026-06-14T06:16:23.533

Link: CVE-2026-46303

Redhat

Severity : Moderate

Publid Date: 2026-06-08T00:00:00Z

Links: CVE-2026-46303 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-24T11:45:02Z

Weaknesses

CWE-125

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object