Skip to content
Fencer Vulns
high 8.2

CVE-2026-46303 json

isofs: validate Rock Ridge CE continuation extent against volume size

published 2026-06-08 5 mo ago modified 2026-10-15 25 d ago also EUVD-2026-35168

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

isofs: validate Rock Ridge CE continuation extent against volume size

rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.

With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size.

Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice.

Patch / fix

  • Linux Linux 2.6.33, 3.3, 3.5, 3.11, 3.13, 3.15, 3.18, 3.19, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7, 7.1
  • linux Debian 12 6.1.176-1
  • linux Debian 13 6.12.88-1
  • linux Debian 14 7.0.7-1

debian advisories DEBIAN-CVE-2026-46303

  • linux Ubuntu 22.04 LTS 5.15.0-186.196
  • linux Ubuntu 24.04 LTS 6.8.0-136.136
  • linux Ubuntu 26.04 LTS 7.0.0-28.28
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1009.9
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72

ubuntu advisories UBUNTU-CVE-2026-46303

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.2 6.12.0-211.42.1.el10_2
  • rv RHEL 10.2 6.12.0-211.42.1.el10_2
  • perf RHEL 10.2 6.12.0-211.42.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.42.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.42.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.42.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.42.1.el10_2
  • kernel-core RHEL 10.2 6.12.0-211.42.1.el10_2

red hat advisories RHSA-2026:49211

  • kernel-source openSUSE Tumbleweed 7.0.12-1.1

opensuse advisories openSUSE-SU-2026:11014-1

  • kernel AlmaLinux 10 6.12.0-211.42.1.el10_2
  • rv AlmaLinux 10 6.12.0-211.42.1.el10_2
  • perf AlmaLinux 10 6.12.0-211.42.1.el10_2
  • rtla AlmaLinux 10 6.12.0-211.42.1.el10_2
  • libperf AlmaLinux 10 6.12.0-211.42.1.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.42.1.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.42.1.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.42.1.el10_2

almalinux advisories ALSA-2026:49211

  • kernel Rocky Linux 10 6.12.0-211.42.1.el10_2

rocky linux advisories RLSA-2026:49211

  • kernel Azure Linux 3.0 6.6.141.1-1

azure linux advisories AZL-89664

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-46303 updated cvss 5.5

kernel: isofs: validate Rock Ridge CE continuation extent against volume size

  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.42.1.el10_2, perf 6.12.0-211.42.1.el10_2, rtla 6.12.0-211.42.1.el10_2, python3-perf 6.12.0-211.42.1.el10_2, kernel-devel-matched 6.12.0-211.42.1.el10_2, kernel-64k-devel-matched 6.12.0-211.42.1.el10_2, +7 more Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.42.1.el10_2, kernel-64k 6.12.0-211.42.1.el10_2, kernel-core 6.12.0-211.42.1.el10_2, kernel-tools 6.12.0-211.42.1.el10_2, kernel-modules 6.12.0-211.42.1.el10_2, kernel-64k-core 6.12.0-211.42.1.el10_2, +28 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.42.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.42.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.42.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.42.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.42.1.el10_2 Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.42.1.el10_2, kernel-rt-64k 6.12.0-211.42.1.el10_2, kernel-rt-core 6.12.0-211.42.1.el10_2, kernel-rt-modules 6.12.0-211.42.1.el10_2, kernel-rt-64k-core 6.12.0-211.42.1.el10_2, kernel-rt-debug-core 6.12.0-211.42.1.el10_2, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.42.1.el10_2, kernel-rt-core 6.12.0-211.42.1.el10_2, kernel-rt-modules 6.12.0-211.42.1.el10_2, kernel-rt-debug-core 6.12.0-211.42.1.el10_2, kernel-rt-modules-core 6.12.0-211.42.1.el10_2, kernel-rt-debug-modules 6.12.0-211.42.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:49211
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-11 updated cvss 8.2

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.7 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.7
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-295-16 updated cvss 8.2

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

  • Linux Linux
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.