Executive brief
A vulnerability in the Linux kernel's handling of ISO 9660 (CD-ROM) images could allow an attacker to read sensitive information from the computer's memory. By providing a specially crafted disc or image file, an attacker can trick the system into disclosing data that should be private. This is particularly relevant for systems that automatically mount removable media when they are plugged in.
Technical details
An out-of-bounds read vulnerability exists in fs/isofs/rock.c within the get_symlink_chunk() and parse_rock_ridge_inode_internal() functions. The issue stems from a failure to validate that the length of a Rock Ridge 'SL' (symbolic link) component header fits within the remaining bytes of the record. An attacker can provide a crafted ISO 9660 image with a malformed SL record; when the kernel processes this record, it may read up to 255 bytes beyond the intended buffer. If the record is located at the end of a kmalloc'ed block, this read can cross allocation boundaries and copy adjacent kernel memory into the symlink body returned to user space via the readlink() system call. This is exploitable via auto-mounting services like udisks2 that do not require administrative privileges.
Affected products
- Linux Linux Kernel 1da177e4c3f4 to 1015e1c4b2fadd9c09704e24738e46598778c869
Timeline
- 2026-06-07: other: Vulnerability reported by researcher
- 2026-07-24: patched: Fix committed to stable kernel tree
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869
- https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee
- https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1
- https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee
- https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b
- https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3
- https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d