{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-08T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: isofs: validate Rock Ridge CE continuation extent against volume size",
    "id" : "2486471",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2486471"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-125",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nisofs: validate Rock Ridge CE continuation extent against volume size\nrock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE\nrecord and passes it to sb_bread() without checking that the block\nnumber is within the mounted ISO 9660 volume.  commit e595447e177b\n(\"[PATCH] rock.c: handle corrupted directories\") added cont_offset\nand cont_size rejection for the CE continuation but did not validate\nthe extent block number itself.  commit f54e18f1b831 (\"isofs: Fix\ninfinite looping over CE entries\") later capped the CE chain length\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.\nWith a crafted ISO mounted via udisks2 (desktop optical auto-mount)\nor via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at\nan out-of-range block or at blocks belonging to an adjacent\nfilesystem on the same block device.  sb_bread() on an out-of-range\nblock returns NULL cleanly via the block layer EIO path, so there\nis no memory-safety violation.  For in-range reads of adjacent-\nfilesystem data, the CE buffer is parsed as Rock Ridge records and\nonly the text of SL sub-records reaches userspace through\nreadlink(), which makes the info-leak channel narrow and difficult\nto exploit; still, rejecting the malformed CE outright matches the\nrejection shape already present in the same function for\ncont_offset and cont_size.\nAdd an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next\nto the existing offset/size rejection, printing the same\ncorrupted-directory-entry notice.", "A flaw was found in the Linux kernel's isofs filesystem. This vulnerability allows a local attacker, by mounting a specially crafted ISO image, to read data beyond the boundaries of the intended ISO 9660 volume. This out-of-bounds read could lead to information disclosure, potentially exposing sensitive data from adjacent filesystems on the same block device." ],
  "statement" : "This Moderate flaw in the Linux kernel's isofs filesystem allows a local attacker to disclose information. Exploitation requires local access and the ability to mount a specially crafted ISO image, which could occur via `CAP_SYS_ADMIN` or through desktop auto-mount features like `udisks2`. This could expose sensitive data from adjacent filesystems on the same block device.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:49211",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.42.1.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-46303\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46303\nhttps://lore.kernel.org/linux-cve-announce/2026060859-CVE-2026-46303-d951@gregkh/T" ],
  "name" : "CVE-2026-46303",
  "mitigation" : {
    "value" : "To reduce exposure, restrict the ability of untrusted users to mount ISO images. If the `isofs` kernel module is not essential for system operation, it can be prevented from loading.\nTo blacklist the `isofs` module:\n1. Create or edit `/etc/modprobe.d/blacklist-isofs.conf` and add:\n```\nblacklist isofs\ninstall isofs /bin/true\n```\n2. Regenerate the initramfs to apply the change:\n```bash\ndracut -f -v\n```\n3. A system reboot is required for this change to take full effect. This action may affect functionality requiring ISO 9660 filesystem mounts.",
    "lang" : "en:us"
  },
  "csaw" : false
}