HighFix available
isofs: validate Rock Ridge CE continuation extent against volume size
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offs
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.258, 5.15.209, 6.1.175, 6.12.88, 6.18.30, 6.6.140, 7.0.7
- CVEs
- CVE-2026-46303
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 07:54 UTC · Revision 1
Source evidence
isofs: validate Rock Ridge CE continuation extent against volume size
core-osv · Original sourcePublished 8 Jun 2026, 15:46 UTC
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offs
osv:CVE-2026-46303
Kernel
Fixed versions: 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7
Complete source record
{
"id": "d18459a9f55d6cc70d31ad91070291290c5a665703dd0bf2e607eb958d7696ce",
"url": "https://osv.dev/vulnerability/CVE-2026-46303",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "isofs: validate Rock Ridge CE continuation extent against volume size",
"summary": "In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b (\"[PATCH] rock.c: handle corrupted directories\") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 (\"isofs: Fix infinite looping over CE entries\") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offs",
"evidence": "osv:CVE-2026-46303",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.258",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.209",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.175",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.140",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.88",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.30",
"evidence": "/affected/1/ranges"
},
{
"value": "7.0.7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-46303",
"aliases": [
"CVE-2026-46303"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f54e18f1b831c92f6512d2eedb224cd63d607d3d"
},
{
"fixed": "8356fb821016797f5677cbeee5ddc0d32a95b4be"
},
{
"fixed": "d582e12378bc1637f337622feef762f53c43fd57"
},
{
"fixed": "bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9"
},
{
"fixed": "c9b37c8b73f6368e4750e5ccb0632c380b43c6e5"
},
{
"fixed": "22b36fa081f38ab397c7697f9d539211b51a0cfc"
},
{
"fixed": "e69da8eeab74b4f4505024c38a17bce060fe7df8"
},
{
"fixed": "ef048470c90bc8c1b8318bb2ce329da9ef64b9fe"
},
{
"fixed": "a36d990f591320e9dd379ab30063ebfe91d47e1f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "2.6.32.66"
},
{
"fixed": "2.6.33"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.2.67"
},
{
"fixed": "3.3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.4.107"
},
{
"fixed": "3.5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.10.64"
},
{
"fixed": "3.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.12.36"
},
{
"fixed": "3.13"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.14.28"
},
{
"fixed": "3.15"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.17.8"
},
{
"fixed": "3.18"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.18.2"
},
{
"fixed": "3.19"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "212c4d33ca83e2144064fe9c2911607fbed5386f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "96e44adce250199ec9b2b928be66365779ff1b59"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1fe5620fcd6c2f0a4a927ee10c8e53196da392f3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fbce0d7dc8965c9fb8d411862040239d4a768c71"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8190393a88f2b0321263a54f2a9eb5a2aa43be7e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "486aa789eadcf44ed87f972b209299c516454693"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "b6d20edb6e7cedb4eedb9e0193d20dd488ebae84"
}
]
}
],
"versions": [
"v2.6.32.71",
"v2.6.32.70",
"v2.6.32.69",
"v2.6.32.68",
"v2.6.32.67",
"v2.6.32.66",
"v3.2.102",
"v3.2.101",
"v3.2.100",
"v3.2.99",
"v3.2.98",
"v3.2.97",
"v3.2.96",
"v3.2.95",
"v3.2.94",
"v3.2.93",
"v3.2.92",
"v3.2.91",
"v3.2.90",
"v3.2.89",
"v3.2.88",
"v3.2.87",
"v3.2.86",
"v3.2.85",
"v3.2.84",
"v3.2.83",
"v3.2.82",
"v3.2.81",
"v3.2.80",
"v3.2.79",
"v3.2.78",
"v3.2.77",
"v3.2.76",
"v3.2.75",
"v3.2.74",
"v3.2.73",
"v3.2.72",
"v3.2.71",
"v3.2.70",
"v3.2.69",
"v3.2.68",
"v3.2.67",
"v3.4.113",
"v3.4.112",
"v3.4.111",
"v3.4.110",
"v3.4.109",
"v3.4.108",
"v3.4.107",
"v3.10.108",
"v3.10.107",
"v3.10.106",
"v3.10.105",
"v3.10.104",
"v3.10.103",
"v3.10.102",
"v3.10.101",
"v3.10.100",
"v3.10.99",
"v3.10.98",
"v3.10.97",
"v3.10.96",
"v3.10.95",
"v3.10.94",
"v3.10.93",
"v3.10.92",
"v3.10.91",
"v3.10.90",
"v3.10.89",
"v3.10.88",
"v3.10.87",
"v3.10.86",
"v3.10.85",
"v3.10.84",
"v3.10.83",
"v3.10.82",
"v3.10.81",
"v3.10.80",
"v3.10.79",
"v3.10.78",
"v3.10.77",
"v3.10.76",
"v3.10.75",
"v3.10.74",
"v3.10.73",
"v3.10.72",
"v3.10.71",
"v3.10.70",
"v3.10.69",
"v3.10.68",
"v3.10.67",
"v3.10.66",
"v3.10.65",
"v3.10.64",
"v3.12.74",
"v3.12.73",
"v3.12.72",
"v3.12.71",
"v3.12.70",
"v3.12.69",
"v3.12.68",
"v3.12.67",
"v3.12.66",
"v3.12.65",
"v3.12.64",
"v3.12.63",
"v3.12.62",
"v3.12.61",
"v3.12.60",
"v3.12.59",
"v3.12.58",
"v3.12.57",
"v3.12.56",
"v3.12.55",
"v3.12.54",
"v3.12.53",
"v3.12.52",
"v3.12.51",
"v3.12.50",
"v3.12.49",
"v3.12.48",
"v3.12.47",
"v3.12.46",
"v3.12.45",
"v3.12.44",
"v3.12.43",
"v3.12.42",
"v3.12.41",
"v3.12.40",
"v3.12.39",
"v3.12.38",
"v3.12.37",
"v3.12.36",
"v3.14.79",
"v3.14.78",
"v3.14.77",
"v3.14.76",
"v3.14.75",
"v3.14.74",
"v3.14.73",
"v3.14.72",
"v3.14.71",
"v3.14.70",
"v3.14.69",
"v3.14.68",
"v3.14.67",
"v3.14.66",
"v3.14.65",
"v3.14.64",
"v3.14.63",
"v3.14.62",
"v3.14.61",
"v3.14.60",
"v3.14.59",
"v3.14.58",
"v3.14.57",
"v3.14.56",
"v3.14.55",
"v3.14.54",
"v3.14.53",
"v3.14.52",
"v3.14.51",
"v3.14.50",
"v3.14.49",
"v3.14.48",
"v3.14.47",
"v3.14.46",
"v3.14.45",
"v3.14.44",
"v3.14.43",
"v3.14.42",
"v3.14.41",
"v3.14.40",
"v3.14.39",
"v3.14.38",
"v3.14.37",
"v3.14.36",
"v3.14.35",
"v3.14.34",
"v3.14.33",
"v3.14.32",
"v3.14.31",
"v3.14.30",
"v3.14.29",
"v3.14.28",
"v3.17.8",
"v3.18.140",
"v3.18.139",
"v3.18.138",
"v3.18.137",
"v3.18.136",
"v3.18.135",
"v3.18.134",
"v3.18.133",
"v3.18.132",
"v3.18.131",
"v3.18.130",
"v3.18.129",
"v3.18.128",
"v3.18.127",
"v3.18.126",
"v3.18.125",
"v3.18.124",
"v3.18.123",
"v3.18.122",
"v3.18.121",
"v3.18.120",
"v3.18.119",
"v3.18.118",
"v3.18.117",
"v3.18.116",
"v3.18.115",
"v3.18.114",
"v3.18.113",
"v3.18.112",
"v3.18.111",
"v3.18.110",
"v3.18.109",
"v3.18.108",
"v3.18.107",
"v3.18.106",
"v3.18.105",
"v3.18.104",
"v3.18.103",
"v3.18.102",
"v3.18.101",
"v3.18.100",
"v3.18.99",
"v3.18.98",
"v3.18.97",
"v3.18.96",
"v3.18.95",
"v3.18.94",
"v3.18.93",
"v3.18.92",
"v3.18.91",
"v3.18.90",
"v3.18.89",
"v3.18.88",
"v3.18.87",
"v3.18.86",
"v3.18.85",
"v3.18.84",
"v3.18.83",
"v3.18.82",
"v3.18.81",
"v3.18.80",
"v3.18.79",
"v3.18.78",
"v3.18.77",
"v3.18.76",
"v3.18.75",
"v3.18.74",
"v3.18.73",
"v3.18.72",
"v3.18.71",
"v3.18.70",
"v3.18.69",
"v3.18.68",
"v3.18.67",
"v3.18.66",
"v3.18.65",
"v3.18.64",
"v3.18.63",
"v3.18.62",
"v3.18.61",
"v3.18.60",
"v3.18.59",
"v3.18.58",
"v3.18.57",
"v3.18.56",
"v3.18.55",
"v3.18.54",
"v3.18.53",
"v3.18.52",
"v3.18.51",
"v3.18.50",
"v3.18.49",
"v3.18.48",
"v3.18.47",
"v3.18.46",
"v3.18.45",
"v3.18.44",
"v3.18.43",
"v3.18.42",
"v3.18.41",
"v3.18.40",
"v3.18.39",
"v3.18.38",
"v3.18.37",
"v3.18.36",
"v3.18.35",
"v3.18.34",
"v3.18.33",
"v3.18.32",
"v3.18.31",
"v3.18.30",
"v3.18.29",
"v3.18.28",
"v3.18.27",
"v3.18.26",
"v3.18.25",
"v3.18.24",
"v3.18.23",
"v3.18.22",
"v3.18.21",
"v3.18.20",
"v3.18.19",
"v3.18.18",
"v3.18.17",
"v3.18.16",
"v3.18.15",
"v3.18.14",
"v3.18.13",
"v3.18.12",
"v3.18.11",
"v3.18.10",
"v3.18.9",
"v3.18.8",
"v3.18.7",
"v3.18.6",
"v3.18.5",
"v3.18.4",
"v3.18.3",
"v3.18.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46303.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.19.0"
},
{
"fixed": "5.10.258"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.209"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.175"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.140"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.88"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.30"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.0.7"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46303.json"
}
}
],
"modified": "2026-10-28T02:30:50.342408235Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
"https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc",
"https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be",
"https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f",
"https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9",
"https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5",
"https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57",
"https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8",
"https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46303.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-46303",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46303.json"
}
},
"related_cves": [
{
"value": "CVE-2026-46303",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518689,
"published_at": "2026-06-08T15:46:30.642+00:00"
}