SECUFOCUSNOW
Home›CVE index›CVE-2026-46303
Review reviewHigh

CVE-2026-46303

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE...

CVSS
8.2
EPSS
0.28%
20.1% percentile
CISA KEV
Not listed
Published
2026.06.09
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.28%
Technical severityCVSS 8.2

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= f54e18f1b831c92f6512d2eedb224cd63d607d3d < 8356fb821016797f5677cbeee5ddc0d32a95b4be, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < d582e12378bc1637f337622feef762f53c43fd57, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < c9b37c8b73f6368e4750e5ccb0632c380b43c6e5, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < 22b36fa081f38ab397c7697f9d539211b51a0cfc, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < e69da8eeab74b4f4505024c38a17bce060fe7df8, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < ef048470c90bc8c1b8318bb2ce329da9ef64b9fe, >= f54e18f1b831c92f6512d2eedb224cd63d607d3d < a36d990f591320e9dd379ab30063ebfe91d47e1f, >= 08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56, >= 212c4d33ca83e2144064fe9c2911607fbed5386f, >= 96e44adce250199ec9b2b928be66365779ff1b59, >= 1fe5620fcd6c2f0a4a927ee10c8e53196da392f3, >= fbce0d7dc8965c9fb8d411862040239d4a768c71, >= 8190393a88f2b0321263a54f2a9eb5a2aa43be7e, >= 486aa789eadcf44ed87f972b209299c516454693, >= b6d20edb6e7cedb4eedb9e0193d20dd488ebae84, >= 2.6.32.66 < 2.6.33, >= 3.2.67 < 3.3, >= 3.4.107 < 3.5, >= 3.10.64 < 3.11
Fixed versions
2.6.33, 3.3, 3.5, 3.11, 3.13, 3.15, 3.18, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE
CWE-401
CVE-2026-46303 — Linux Linux, linux kernel | SECUFOCUS NOW