PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46303 Linux CVE debrief

A vulnerability was found in the Linux kernel's isofs module. The vulnerability is caused by a lack of validation for the Rock Ridge CE continuation extent, which can lead to an out-of-range block or blocks belonging to an adjacent filesystem being accessed. This can result in an information leak. The vulnerability has been resolved by adding an ISOFS_SB(sb)->s_nzones bounds check to rock_continue().

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-09-08
Advisory published
2026-06-08
Advisory updated
2026-09-08

Who should care

Users of the Linux kernel who use the isofs module, especially those who mount ISO 9660 volumes, should be aware of this vulnerability. An attacker could potentially exploit this vulnerability to leak information.

Technical summary

The Linux kernel's isofs module did not properly validate the Rock Ridge CE continuation extent, allowing for out-of-range blocks or blocks from adjacent filesystems to be accessed. This has been fixed by adding a bounds check.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from the Linux kernel stable tree: [https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc](ref-4)
  • Update to a Linux kernel version that includes this patch.

Evidence notes

The CVE-2026-46303 vulnerability was made public on [2026-06-08](cvePublishedAt).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46303 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46303

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46303 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46303

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.