CVE-2026-46124

Analyzed Analyzed - Analysis Complete

Integer Overflow in Linux Kernel ISOFS

Publication date: 2026-05-28

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780. sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix. Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-24

Generated

2026-07-07

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46124

EUVD

EUVD-2026-32883

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.15
linux	linux_kernel	6.15
linux	linux_kernel	6.15
linux	linux_kernel	6.15
linux	linux_kernel	6.15
linux	linux_kernel	6.15
linux	linux_kernel	From 6.14.4 (inc) to 6.15 (exc)
linux	linux_kernel	From 5.4.293 (inc) to 5.5 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 5.10.237 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 5.15.181 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.1.135 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.6.88 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.12.25 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.15.1 (inc) to 6.18.30 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's isofs module, specifically in how it handles block numbers from NFS file handles. Functions isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-controlled block number from the NFS file handle to isofs_export_iget(). The only check before reading the block is that the block number is not zero.

An attacker can craft a file handle with a block number that passes the existing checks but causes the server to read any in-range block on the backing device as if it were an iso_directory_record. Although out-of-range blocks return NULL safely, in-range reads can cause unrelated data from adjacent partitions to be interpreted as directory metadata and sent to the NFS client.

The vulnerability affects isofs exported over NFS from loop-mounted images and requires an authenticated NFS peer. The fix involves rejecting block numbers greater than or equal to the total number of zones (s_nzones) to prevent this improper reading.

Impact Analysis

This vulnerability can allow an authenticated NFS client to cause the server to read and expose unintended data from the backing device by supplying a crafted file handle. The server may send unrelated bytes from adjacent partitions as directory metadata to the client.

While there is no memory safety violation or crash, this unintended data exposure could lead to information disclosure of data stored on the device that should not be accessible via the NFS export.

The impact is limited by the narrow deployment surface, as it requires isofs exported over NFS from loop-mounted images and an authenticated NFS peer.

Mitigation Strategies

The vulnerability has been resolved by adding a check to reject block numbers greater than or equal to the number of zones (s_nzones) in isofs_export_iget().

To mitigate this vulnerability, ensure your Linux kernel is updated to a version that includes this fix.

Since the vulnerability affects isofs exported over NFS from loop-mounted images and requires an authenticated NFS peer, limiting or disabling such exports can reduce exposure.

Hi! I’m here to help you understand CVE-2026-46124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70