CVE-2026-46303: Linux isofs Rock Ridge Information Disclosure Vulnerability

Technical summary

The rock_continue() function in the Linux kernel's isofs implementation processes Rock Ridge CE (continuation extent) records to handle larger directory entries. The vulnerability stems from missing bounds validation on the cont_extent field extracted from a CE record. Prior patches added validation for cont_offset and cont_size fields, and later imposed a maximum CE chain length (RR_MAX_CE_ENTRIES = 32), but the extent block number itself was never checked against ISOFS_SB(sb)->s_nzones. An attacker-controlled cont_extent value can reference blocks outside the mounted volume, including blocks belonging to other filesystems on the same block device. When sb_bread() is called with an out-of-range block, it returns NULL via the block layer EIO path (no memory corruption), but valid in-range reads of adjacent filesystem data allow the CE buffer to be parsed as Rock Ridge records. Text from SL (symbolic link) sub-records is copied to userspace, creating a narrow but exploitable information-disclosure channel. The fix adds a bounds check identical in structure to the existing cont_offset/cont_size validation.

Business impact

This vulnerability enables unprivileged or privileged information disclosure on systems that auto-mount optical media or user-supplied ISO images. Desktop environments using udisks2 are particularly at risk, as users can trigger automatic mounting of a malicious ISO without explicit CAP_SYS_ADMIN. The leaked data is limited to Rock Ridge metadata visible through readlink() calls, but may include directory structure and naming information from adjacent filesystems sharing the same block device. In multi-tenant or regulated environments where filesystem isolation is a security requirement, this represents a compliance and confidentiality risk. Servers processing untrusted ISO images (backup verification, archival systems) face a lower but non-zero risk depending on deployment context.

Affected systems

The Linux kernel across all versions with isofs Rock Ridge support are affected. This includes all major distributions (Red Hat Enterprise Linux, Ubuntu, Debian, SUSE, Fedora, etc.) when the isofs module is loaded. Desktop systems with udisks2 and optical drive support are particularly exposed. Embedded systems, containers, and VMs that mount ISO images for package installation or livebooting may also be vulnerable. The vulnerability requires a locally-mounted ISO image, so remote exposure is indirect: an attacker must provide the malicious ISO to a target system. Verify specific patched kernel versions against your vendor's security advisories.

Exploitability

Exploitability requires the ability to mount a crafted ISO image. On a desktop with udisks2, this can be achieved by a local user with minimal privilege—simply inserting physical media or opening a file manager on a downloaded ISO. In data center environments, privileged (CAP_SYS_ADMIN) access is typically required. The information disclosure is not arbitrary memory read; it is bounded to Rock Ridge metadata in adjacent filesystems on the same block device. Extracting useful data (filenames, symlink targets) requires knowledge of the adjacent filesystem layout and the attacker's ability to interpret Rock Ridge structures. No kernel crash, privilege escalation, or code execution is possible—the attack surface is purely informational. Exploitation difficulty is low for local access scenarios, moderate for crafting a profitable payload.

Remediation

Apply a kernel security update that adds bounds validation for the cont_extent field against s_nzones in rock_continue(). This patch should be included in future stable kernel releases and backported to LTS branches. The fix is a straightforward validation check, not a structural change, so integration and testing burden is minimal. In the interim, disable isofs kernel module loading if optical media or ISO mounting is not required, or restrict mount privileges to trusted administrators. Use mount options to disable Rock Ridge extension parsing if supported by your kernel version, though this may reduce ISO functionality.

Patch guidance

Monitor your Linux distribution's security bulletins for kernel updates addressing CVE-2026-46303. Most distributions will release patched kernel versions within 2–4 weeks of vulnerability publication. For Red Hat Enterprise Linux, Canonical, and SUSE, check their respective CVE tracking pages and apply the latest kernel errata or security updates. Verify the patch includes the s_nzones bounds check in rock_continue() by reviewing the commit message or patch file. If a kernel update is not yet available from your vendor, confirm the advisory's expected release date before deploying compensating controls. Test patches in a staging environment before production rollout to ensure ISO functionality and performance are unaffected.

Detection guidance

Monitor kernel logs for 'corrupted directory entry' messages from isofs, which indicate a rejected CE record. These logs may increase on systems attempting to mount malicious ISOs. Endpoint detection and response (EDR) tools should flag unusual isofs mount attempts with user-supplied media or files. Network detection is not applicable; focus on local filesystem access auditing. In forensic analysis, examine auditd logs for mount syscalls with untrusted ISO images, and correlate with readlink() or open() calls on symlink-heavy directory trees. No userspace signature is available; detection is behavioral and log-based. Systems with strict mount policies should log all mount attempts regardless of privilege level.

Why prioritize this

CVE-2026-46303 scores 8.2 (HIGH) due to high confidentiality impact and low attack complexity. Prioritization should reflect your environment's exposure to untrusted ISO mounting: desktop systems and development environments require faster patching; servers in locked-down data centers can follow standard patch cycles. The lack of privilege escalation or denial-of-service impact means this is not a critical emergency, but the ease of exploitation on desktop systems and the simplicity of the fix warrant prompt attention within 30 days. If your organization does not mount user-supplied ISO images, risk is lower and standard patch timelines apply.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects: high confidentiality impact (C:H) from potential information disclosure of adjacent filesystem metadata; low integrity impact (I:L) because only directory metadata, not code or system state, is at risk; no availability impact (A:N) because the kernel does not crash; network-adjacent attack surface (AV:N) because ISO mounting can be triggered by unprivileged users on networked systems receiving files; low complexity (AC:L) because no race conditions or advanced techniques are needed; no privilege requirement (PR:N) in desktop auto-mount scenarios. The score appropriately flags this as actionable but not critical, as exploitability is bounded and impact is informational rather than catastrophic.

Frequently asked questions