CVE-2026-46303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46303", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.111Z", "datePublished": "2026-06-08T15:46:30.642Z", "dateUpdated": "2026-11-10T12:47:27.221Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:06.574Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate Rock Ridge CE continuation extent against volume size\n\nrock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE\nrecord and passes it to sb_bread() without checking that the block\nnumber is within the mounted ISO 9660 volume. commit e595447e177b\n(\"[PATCH] rock.c: handle corrupted directories\") added cont_offset\nand cont_size rejection for the CE continuation but did not validate\nthe extent block number itself. commit f54e18f1b831 (\"isofs: Fix\ninfinite looping over CE entries\") later capped the CE chain length\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.\n\nWith a crafted ISO mounted via udisks2 (desktop optical auto-mount)\nor via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at\nan out-of-range block or at blocks belonging to an adjacent\nfilesystem on the same block device. sb_bread() on an out-of-range\nblock returns NULL cleanly via the block layer EIO path, so there\nis no memory-safety violation. For in-range reads of adjacent-\nfilesystem data, the CE buffer is parsed as Rock Ridge records and\nonly the text of SL sub-records reaches userspace through\nreadlink(), which makes the info-leak channel narrow and difficult\nto exploit; still, rejecting the malformed CE outright matches the\nrejection shape already present in the same function for\ncont_offset and cont_size.\n\nAdd an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next\nto the existing offset/size rejection, printing the same\ncorrupted-directory-entry notice."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - isofs supports NFS export (export.c), and nfsd_readlink()/LOOKUP on an exported mount reach rock_continue() through vfs_get_link() and isofs_iget() without any local syscall on the attacking host.\nAC:L - The attacker fully controls CE extent, offset, and size in a crafted ISO image, so triggering the bad sb_bread() path is reliable once the image is mounted and accessed.\nPR:N - A remote NFS client needs only network access to an exported isofs mount to invoke symlink readlink and directory inode parsing; no CAP_SYS_ADMIN or host root on the attacker's machine is required.\nUI:N - An attacker with a local shell can loop-mount a malicious ISO inside a user namespace (CAP_SYS_ADMIN there) and trigger exploitation without any separate victim action.\nS:U - Impact is unauthorized kernel-mediated reads and limited inode metadata skew on the same host; there is no VM escape, sandbox breakout, or cross-security-authority boundary change.\nC:H - In-range CE extents can cause sb_bread() to fetch blocks from an adjacent filesystem on the same device, and mis-parsed Rock Ridge SL text is returned to userspace through readlink(), constituting unauthorized data disclosure.\nI:L - Adjacent-block data parsed as Rock Ridge PX/PN/CL records during inode setup can overwrite inode mode, ownership, device numbers, or relocation fields, but there is no arbitrary kernel write or memory corruption.\nA:N - Out-of-range blocks fail cleanly through sb_bread()'s NULL/EIO path with no oops, panic, or hang; errors propagate as -EIO to the calling syscall or NFS operation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/isofs/rock.c"], "versions": [{"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "8356fb821016797f5677cbeee5ddc0d32a95b4be", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "d582e12378bc1637f337622feef762f53c43fd57", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "c9b37c8b73f6368e4750e5ccb0632c380b43c6e5", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "22b36fa081f38ab397c7697f9d539211b51a0cfc", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "e69da8eeab74b4f4505024c38a17bce060fe7df8", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "ef048470c90bc8c1b8318bb2ce329da9ef64b9fe", "status": "affected", "versionType": "git"}, {"version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "lessThan": "a36d990f591320e9dd379ab30063ebfe91d47e1f", "status": "affected", "versionType": "git"}, {"version": "08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56", "status": "affected", "versionType": "git"}, {"version": "212c4d33ca83e2144064fe9c2911607fbed5386f", "status": "affected", "versionType": "git"}, {"version": "96e44adce250199ec9b2b928be66365779ff1b59", "status": "affected", "versionType": "git"}, {"version": "1fe5620fcd6c2f0a4a927ee10c8e53196da392f3", "status": "affected", "versionType": "git"}, {"version": "fbce0d7dc8965c9fb8d411862040239d4a768c71", "status": "affected", "versionType": "git"}, {"version": "8190393a88f2b0321263a54f2a9eb5a2aa43be7e", "status": "affected", "versionType": "git"}, {"version": "486aa789eadcf44ed87f972b209299c516454693", "status": "affected", "versionType": "git"}, {"version": "b6d20edb6e7cedb4eedb9e0193d20dd488ebae84", "status": "affected", "versionType": "git"}, {"version": "2.6.32.66", "lessThan": "2.6.33", "status": "affected", "versionType": "semver"}, {"version": "3.2.67", "lessThan": "3.3", "status": "affected", "versionType": "semver"}, {"version": "3.4.107", "lessThan": "3.5", "status": "affected", "versionType": "semver"}, {"version": "3.10.64", "lessThan": "3.11", "status": "affected", "versionType": "semver"}, {"version": "3.12.36", "lessThan": "3.13", "status": "affected", "versionType": "semver"}, {"version": "3.14.28", "lessThan": "3.15", "status": "affected", "versionType": "semver"}, {"version": "3.17.8", "lessThan": "3.18", "status": "affected", "versionType": "semver"}, {"version": "3.18.2", "lessThan": "3.19", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/isofs/rock.c"], "versions": [{"version": "3.19", "status": "affected"}, {"version": "0", "lessThan": "3.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4.107"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be"}, {"url": "https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57"}, {"url": "https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9"}, {"url": "https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5"}, {"url": "https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc"}, {"url": "https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8"}, {"url": "https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe"}, {"url": "https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f"}], "title": "isofs: validate Rock Ridge CE continuation extent against volume size", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:47:27.221Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/isofs/rock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8356fb821016797f5677cbeee5ddc0d32a95b4be", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "d582e12378bc1637f337622feef762f53c43fd57", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "c9b37c8b73f6368e4750e5ccb0632c380b43c6e5", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "22b36fa081f38ab397c7697f9d539211b51a0cfc", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "e69da8eeab74b4f4505024c38a17bce060fe7df8", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "ef048470c90bc8c1b8318bb2ce329da9ef64b9fe", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"lessThan": "a36d990f591320e9dd379ab30063ebfe91d47e1f", "status": "affected", "version": "f54e18f1b831c92f6512d2eedb224cd63d607d3d", "versionType": "git"}, {"status": "affected", "version": "08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56", "versionType": "git"}, {"status": "affected", "version": "212c4d33ca83e2144064fe9c2911607fbed5386f", "versionType": "git"}, {"status": "affected", "version": "96e44adce250199ec9b2b928be66365779ff1b59", "versionType": "git"}, {"status": "affected", "version": "1fe5620fcd6c2f0a4a927ee10c8e53196da392f3", "versionType": "git"}, {"status": "affected", "version": "fbce0d7dc8965c9fb8d411862040239d4a768c71", "versionType": "git"}, {"status": "affected", "version": "8190393a88f2b0321263a54f2a9eb5a2aa43be7e", "versionType": "git"}, {"status": "affected", "version": "486aa789eadcf44ed87f972b209299c516454693", "versionType": "git"}, {"status": "affected", "version": "b6d20edb6e7cedb4eedb9e0193d20dd488ebae84", "versionType": "git"}, {"lessThan": "2.6.33", "status": "affected", "version": "2.6.32.66", "versionType": "semver"}, {"lessThan": "3.3", "status": "affected", "version": "3.2.67", "versionType": "semver"}, {"lessThan": "3.5", "status": "affected", "version": "3.4.107", "versionType": "semver"}, {"lessThan": "3.11", "status": "affected", "version": "3.10.64", "versionType": "semver"}, {"lessThan": "3.13", "status": "affected", "version": "3.12.36", "versionType": "semver"}, {"lessThan": "3.15", "status": "affected", "version": "3.14.28", "versionType": "semver"}, {"lessThan": "3.18", "status": "affected", "version": "3.17.8", "versionType": "semver"}, {"lessThan": "3.19", "status": "affected", "version": "3.18.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/isofs/rock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"lessThan": "3.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE79466A-8004-4545-9F2B-9AE61FF25E49", "versionEndExcluding": "2.6.33", "versionStartIncluding": "2.6.32.66", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E339763B-0FFB-4F77-925F-B75B0574196F", "versionEndExcluding": "3.3", "versionStartIncluding": "3.2.67", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D756A04-79C7-4DB6-9A50-9E8E5B2757F2", "versionEndExcluding": "3.5", "versionStartIncluding": "3.4.107", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B3FB946-FA61-41D1-8295-A7D889D63B3E", "versionEndExcluding": "3.11", "versionStartIncluding": "3.10.64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "881E140A-B761-4577-B10F-CF48988916FB", "versionEndExcluding": "3.13", "versionStartIncluding": "3.12.36", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA5F1F71-BA36-4EC2-A59D-E285C9983115", "versionEndExcluding": "3.15", "versionStartIncluding": "3.14.28", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1743B4F8-1859-415F-9EB5-A33C53ABCD2E", "versionEndExcluding": "3.18", "versionStartIncluding": "3.17.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C5C08E2-8006-4964-BA58-B339247E1301", "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.18.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate Rock Ridge CE continuation extent against volume size\n\nrock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE\nrecord and passes it to sb_bread() without checking that the block\nnumber is within the mounted ISO 9660 volume. commit e595447e177b\n(\"[PATCH] rock.c: handle corrupted directories\") added cont_offset\nand cont_size rejection for the CE continuation but did not validate\nthe extent block number itself. commit f54e18f1b831 (\"isofs: Fix\ninfinite looping over CE entries\") later capped the CE chain length\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.\n\nWith a crafted ISO mounted via udisks2 (desktop optical auto-mount)\nor via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at\nan out-of-range block or at blocks belonging to an adjacent\nfilesystem on the same block device. sb_bread() on an out-of-range\nblock returns NULL cleanly via the block layer EIO path, so there\nis no memory-safety violation. For in-range reads of adjacent-\nfilesystem data, the CE buffer is parsed as Rock Ridge records and\nonly the text of SL sub-records reaches userspace through\nreadlink(), which makes the info-leak channel narrow and difficult\nto exploit; still, rejecting the malformed CE outright matches the\nrejection shape already present in the same function for\ncont_offset and cont_size.\n\nAdd an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next\nto the existing offset/size rejection, printing the same\ncorrupted-directory-entry notice."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nisofs: validar la extensi\u00f3n de continuaci\u00f3n Rock Ridge CE contra el tama\u00f1o del volumen\n\nrock_continue() lee rs->cont_extent textualmente del registro Rock Ridge CE y lo pasa a sb_bread() sin verificar que el n\u00famero de bloque est\u00e9 dentro del volumen ISO 9660 montado. El commit e595447e177b ('[PATCH] rock.c: handle corrupted directories') a\u00f1adi\u00f3 el rechazo de cont_offset y cont_size para la continuaci\u00f3n CE pero no valid\u00f3 el n\u00famero de bloque de la extensi\u00f3n en s\u00ed. El commit f54e18f1b831 ('isofs: Fix infinite looping over CE entries') m\u00e1s tarde limit\u00f3 la longitud de la cadena CE a RR_MAX_CE_ENTRIES = 32 pero de nuevo dej\u00f3 el n\u00famero de bloque sin verificar.\n\nCon un ISO manipulado montado v\u00eda udisks2 (montaje autom\u00e1tico \u00f3ptico de escritorio) o v\u00eda montaje CAP_SYS_ADMIN, rs->cont_extent puede, por lo tanto, apuntar a un bloque fuera de rango o a bloques pertenecientes a un sistema de archivos adyacente en el mismo dispositivo de bloques. sb_bread() en un bloque fuera de rango devuelve NULL limpiamente v\u00eda la ruta EIO de la capa de bloques, por lo que no hay violaci\u00f3n de seguridad de memoria. Para lecturas dentro de rango de datos de sistemas de archivos adyacentes, el b\u00fafer CE se analiza como registros Rock Ridge y solo el texto de los subregistros SL llega al espacio de usuario a trav\u00e9s de readlink(), lo que hace que el canal de fuga de informaci\u00f3n sea estrecho y dif\u00edcil de exploit; a\u00fan as\u00ed, rechazar el CE malformado directamente coincide con la forma de rechazo ya presente en la misma funci\u00f3n para cont_offset y cont_size.\n\nA\u00f1adir una verificaci\u00f3n de l\u00edmites ISOFS_SB(sb)->s_nzones a rock_continue() junto al rechazo existente de offset/size, imprimiendo el mismo aviso de entrada de directorio corrupta."}], "id": "CVE-2026-46303", "lastModified": "2026-11-10T13:19:17.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-08T17:16:48.853", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: isofs: validate Rock Ridge CE continuation extent against volume size", "id": "2486471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486471"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nisofs: validate Rock Ridge CE continuation extent against volume size\nrock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE\nrecord and passes it to sb_bread() without checking that the block\nnumber is within the mounted ISO 9660 volume. commit e595447e177b\n(\"[PATCH] rock.c: handle corrupted directories\") added cont_offset\nand cont_size rejection for the CE continuation but did not validate\nthe extent block number itself. commit f54e18f1b831 (\"isofs: Fix\ninfinite looping over CE entries\") later capped the CE chain length\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.\nWith a crafted ISO mounted via udisks2 (desktop optical auto-mount)\nor via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at\nan out-of-range block or at blocks belonging to an adjacent\nfilesystem on the same block device. sb_bread() on an out-of-range\nblock returns NULL cleanly via the block layer EIO path, so there\nis no memory-safety violation. For in-range reads of adjacent-\nfilesystem data, the CE buffer is parsed as Rock Ridge records and\nonly the text of SL sub-records reaches userspace through\nreadlink(), which makes the info-leak channel narrow and difficult\nto exploit; still, rejecting the malformed CE outright matches the\nrejection shape already present in the same function for\ncont_offset and cont_size.\nAdd an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next\nto the existing offset/size rejection, printing the same\ncorrupted-directory-entry notice.", "A flaw was found in the Linux kernel's isofs filesystem. This vulnerability allows a local attacker, by mounting a specially crafted ISO image, to read data beyond the boundaries of the intended ISO 9660 volume. This out-of-bounds read could lead to information disclosure, potentially exposing sensitive data from adjacent filesystems on the same block device."], "mitigation": {"lang": "en:us", "value": "To reduce exposure, restrict the ability of untrusted users to mount ISO images. If the `isofs` kernel module is not essential for system operation, it can be prevented from loading.\nTo blacklist the `isofs` module:\n1. Create or edit `/etc/modprobe.d/blacklist-isofs.conf` and add:\n```\nblacklist isofs\ninstall isofs /bin/true\n```\n2. Regenerate the initramfs to apply the change:\n```bash\ndracut -f -v\n```\n3. A system reboot is required for this change to take full effect. This action may affect functionality requiring ISO 9660 filesystem mounts."}, "name": "CVE-2026-46303", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46303\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46303\nhttps://lore.kernel.org/linux-cve-announce/2026060859-CVE-2026-46303-d951@gregkh/T"], "statement": "This Moderate flaw in the Linux kernel's isofs filesystem allows a local attacker to disclose information. Exploitation requires local access and the ability to mount a specially crafted ISO image, which could occur via `CAP_SYS_ADMIN` or through desktop auto-mount features like `udisks2`. This could expose sensitive data from adjacent filesystems on the same block device.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,8356fb821016797f5677cbeee5ddc0d32a95b4be)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,d582e12378bc1637f3377cbeee5ddc0d32a95b4be)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,bf1bc673c587f5ef7e9c09b94aea7c5a7847d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,c9b37c8b73f6368e4750e5ccb0632c380b43c6e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,22b36fa081f38ab397c7697f9d539211b51a0cfc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,e69da8eeab74b4f4505024c38a17bce060fe7df8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,ef048470c90bc8c1b8318bb2ce329da9ef64b9fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f54e18f1b831c92f6512d2eedb224cd63d607d3d,a36d990f591320e9dd379ab30063ebfe91d47e1f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "212c4d33ca83e2144064fe9c2911607fbed5386f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "96e44adce250199ec9b2b928be66365779ff1b59"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1fe5620fcd6c2f0a4a927ee10c8e53196da392f3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "fbce0d7dc8965c9fb8d411862040239d4a768c71"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8190393a88f2b0321263a54f2a9eb5a2aa43be7e"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "486aa789eadcf44ed87f972b209299c516454693"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b6d20edb6e7cedb4eedb9e0193d20dd488ebae84"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.32.66,2.6.33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.2.67,3.3.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.107,3.5.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.10.64,3.11.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.12.36,3.13.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.14.28,3.15.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.8,3.18.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.2,3.19.0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.258,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-08T19:15:30.974835+00:00", "updated": "2026-08-13T20:45:02.479464+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}