{"id":"CVE-2026-46124","state":"PUBLISHED","title":"isofs: validate block number from NFS file handle in isofs_export_iget","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate block number from NFS file handle in isofs_export_iget\n\nisofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-\ncontrolled block number (ifid->block or ifid->parent_block) from\nthe NFS file handle to isofs_export_iget(), which only rejects\nblock == 0 before calling isofs_iget() and ultimately sb_bread().\nA crafted file handle with fh_len sufficient to pass the check\nadded by commit 0405d4b63d08 (\"isofs: Prevent the use of too small\nfid\") can still drive the server to read any in-range block on the\nbacking device as if it were an iso_directory_record.  That earlier\nfix was assigned CVE-2025-37780.\n\nsb_bread() on an out-of-range block returns NULL cleanly via the\nEIO path, so there is no memory-safety violation.  For in-range\nreads of adjacent-partition data on the same block device, the\nunrelated bytes end up in iso_inode_info fields that reach the NFS\nclient as dentry metadata.  The deployment surface (isofs exported\nover NFS from loop-mounted images) is narrow and requires an\nauthenticated NFS peer, but the malformed-file-handle class is\nreportable as hardening next to the existing CVE-2025-37780 fix.\n\nReject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so\nthe check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()\ncall sites with a single line.","publishedAt":"2026-05-28T09:35:38.887Z","updatedAt":"2026-10-19T19:36:51.382Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5e7de55602c61c8ff28db075cc49c8dd6989d7e0","status":"affected","lessThan":"ee0024f5a7e3c73aa253869fae9650ae054093ca","versionType":"git"},{"version":"63d5a3e207bf315a32c7d16de6c89753a759f95a","status":"affected","lessThan":"31dbb4ba0f719ae7774e4c0c95172c9bf81692f5","versionType":"git"},{"version":"0fdafdaef796816a9ed0fd7ac812932d569d9beb","status":"affected","lessThan":"908a76f0b1038035e6ebb4f2293ce079f92e0a02","versionType":"git"},{"version":"952e7a7e317f126d0a2b879fc531b716932d5ffa","status":"affected","lessThan":"bb0988ed4f2e26d59bbb58f644cb3a55b7521e21","versionType":"git"},{"version":"56dfffea9fd3be0b3795a9ca6401e133a8427e0b","status":"affected","lessThan":"0a1af74ae2177bda3aee0837a0546309aa539d0d","versionType":"git"},{"version":"0405d4b63d082861f4eaff9d39c78ee9dc34f845","status":"affected","lessThan":"afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b","versionType":"git"},{"version":"0405d4b63d082861f4eaff9d39c78ee9dc34f845","status":"affected","lessThan":"4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6","versionType":"git"},{"version":"0405d4b63d082861f4eaff9d39c78ee9dc34f845","status":"affected","lessThan":"24376458138387fb251e782e624c7776e9826796","versionType":"git"},{"version":"ee01a309ebf598be1ff8174901ed6e91619f1749","status":"affected","versionType":"git"},{"version":"007124c896e7d4614ac1f6bd4dedb975c35a2a8e","status":"affected","versionType":"git"},{"version":"5.10.237","status":"affected","lessThan":"5.10.258","versionType":"semver"},{"version":"5.15.181","status":"affected","lessThan":"5.15.209","versionType":"semver"},{"version":"6.1.135","status":"affected","lessThan":"6.1.175","versionType":"semver"},{"version":"6.6.88","status":"affected","lessThan":"6.6.140","versionType":"semver"},{"version":"6.12.25","status":"affected","lessThan":"6.12.88","versionType":"semver"},{"version":"5.4.293","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.14.4","status":"affected","lessThan":"6.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/isofs/export.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.88","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.30","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.7","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/isofs/export.c"]}],"references":["https://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca","https://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5","https://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02","https://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21","https://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d","https://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b","https://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6","https://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/46xxx/CVE-2026-46124.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46124","state":"PUBLISHED","datePublished":"2026-05-28T09:35:38.887Z","dateUpdated":"2026-10-19T19:36:51.382Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-13T15:03:33.098Z"},"containers":{"cna":{"title":"isofs: validate block number from NFS file handle in isofs_export_iget","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate block number from NFS file handle in isofs_export_iget\n\nisofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-\ncontrolled block number (ifid->block or ifid->parent_block) from\nthe NFS file handle to isofs_export_iget(), which only rejects\nblock == 0 before calling isofs_iget() and ultimately sb_bread().\nA crafted file handle with fh_len sufficient to pass the check\nadded by commit 0405d4b63d08 (\"isofs: Prevent the use of too small\nfid\") can still drive the server to read any in-range block on the\nbacking device as if it were an iso_directory_record.  That earlier\nfix was assigned CVE-2025-37780.\n\nsb_bread() on an out-of-range block returns NULL cleanly via the\nEIO path, so there is no memory-safety violation.  For in-range\nreads of adjacent-partition data on the same block device, the\nunrelated bytes end up in iso_inode_info fields that reach the NFS\nclient as dentry metadata.  The deployment surface (isofs exported\nover NFS from loop-mounted images) is narrow and requires an\nauthenticated NFS peer, but the malformed-file-handle class is\nreportable as hardening next to the existing CVE-2025-37780 fix.\n\nReject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so\nthe check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()\ncall sites with a single line."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5e7de55602c61c8ff28db075cc49c8dd6989d7e0","status":"affected","lessThan":"ee0024f5a7e3c73aa253869fae9650ae054093ca","versionType":"git"},{"version":"63d5a3e207bf315a32c7d16de6c89753a759f95a","status":"affected","lessThan":"31dbb4ba0f719ae7774e4c0c95172c9bf81692f5","versionType":"git"},{"version":"0fdafdaef796816a9ed0fd7ac812932d569d9beb","status":"affected","lessThan":"908a76f0b1038035e6ebb4f2293ce079f92e0a02","versionType":"git"},{"version":"952e7a7e317f126d0a2b879fc531b716932d5ffa","status":"affected","lessThan":"bb0988ed4f2e26d59bbb58f644cb3a55b7521e21","versionType":"git"},{"version":"56dfffea9fd3be0b3795a9ca6401e133a8427e0b","status":"affected","lessThan":"0a1af74ae2177bda3aee0837a0546309aa539d0d","versionType":"git"},{"version":"0405d4b63d082861f4eaff9d39c78ee9dc34f845","status":"affected","lessThan":"afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b","versionType":"git"},{"version":"0405d4b63d082861f4eaff9d39c78ee9dc34f845","status":"affected","lessThan":"4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6","versionType":"git"},{"version":"0405d4b63d082861f4eaff9d39c78ee9dc34f845","status":"affected","lessThan":"24376458138387fb251e782e624c7776e9826796","versionType":"git"},{"version":"ee01a309ebf598be1ff8174901ed6e91619f1749","status":"affected","versionType":"git"},{"version":"007124c896e7d4614ac1f6bd4dedb975c35a2a8e","status":"affected","versionType":"git"},{"version":"5.10.237","status":"affected","lessThan":"5.10.258","versionType":"semver"},{"version":"5.15.181","status":"affected","lessThan":"5.15.209","versionType":"semver"},{"version":"6.1.135","status":"affected","lessThan":"6.1.175","versionType":"semver"},{"version":"6.6.88","status":"affected","lessThan":"6.6.140","versionType":"semver"},{"version":"6.12.25","status":"affected","lessThan":"6.12.88","versionType":"semver"},{"version":"5.4.293","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.14.4","status":"affected","lessThan":"6.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/isofs/export.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.88","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.30","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.7","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/isofs/export.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca"},{"url":"https://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5"},{"url":"https://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02"},{"url":"https://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21"},{"url":"https://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d"},{"url":"https://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b"},{"url":"https://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6"},{"url":"https://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when nfsd decodes an attacker-supplied NFS file handle (exportfs_decode_fh → isofs_fh_to_dentry), so a remote NFS client triggers it over the network (TCP/UDP 2049).\nAC:L - The attacker fully controls the block field in the file handle and the read is deterministic; no race or uncontrollable memory layout is involved.\nPR:N - The decode runs before per-user permission checks, and the realistic deployment (a read-only ISO exported to a subnet via default AUTH_SYS) lets any permitted network peer craft handles without credentials.\nUI:N - The NFS server processes the crafted request automatically; no victim action is required at attack time beyond the pre-existing export.\nS:U - The impact stays within the kernel filesystem/NFS security authority; no cross-authority boundary (VM, IOMMU, sandbox) is crossed.\nC:H - An out-of-bounds (cross-partition) read of arbitrary in-range blocks on the backing device is disclosed to the NFS client as inode metadata, and is not bounded to a few bytes since the attacker can probe blocks across the device.\nI:N - isofs is mounted strictly read-only and the commit confirms no memory-safety violation, so the attacker cannot modify any data or kernel memory.\nA:N - Out-of-range reads return NULL cleanly via the EIO path and in-range parsing is bounded; the commit and maintainer explicitly confirm no crash, hang, or memory-safety fault."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:29:53.831Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.237","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.181","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.135","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.88","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.25","versionEndExcluding":"6.12.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.0.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.293"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14.4"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:20:40.377Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-46124","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:20:06.239084Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:36:51.382Z"}}]}}}