CVE-2026-64317

What it actually does

This flaw is an out-of-bounds read in the Linux kernel ISO 9660 filesystem driver when parsing Rock Ridge symbolic link records. A malicious ISO image can declare a symbolic-link component length that extends beyond the bounds of the SL record. When the kernel processes that record, it can read up to 255 bytes past the allocated buffer and copy adjacent kernel memory into the symlink target returned to user space via readlink(). The primary impact is kernel memory disclosure; malformed parsing may also cause I/O errors or instability depending on allocator layout and surrounding memory.

Why it matters to the business

Systems that mount untrusted ISO images, removable media, disk images, or virtual media can leak sensitive kernel memory to a local attacker. This is most relevant to desktops, workstations, forensic analysis systems, kiosk systems, build or malware-analysis sandboxes, and servers that process user-supplied ISO files. Because many desktop environments can auto-mount removable media through services such as udisks2, exploitation may be practical without requiring the attacker to have administrative mount privileges. Although this is not known to be exploited in the wild and has low current EPSS, the high confidentiality impact makes patching important for systems exposed to removable or user-supplied media.

How an attack unfolds

An attacker crafts an ISO 9660 image containing Rock Ridge extension metadata with a malformed SL symbolic-link record. The record advertises a component length that exceeds the remaining bytes in the record, ideally placing the record at the end of a small allocated continuation buffer so that parsing crosses into adjacent kernel memory. The attacker then causes the target system to mount the image, for example by inserting removable media, presenting virtual media, or supplying an ISO file to software that mounts or inspects it. When the filesystem driver parses the Rock Ridge inode and a user-space process reads the crafted symlink target, the kernel copies bytes from beyond the malformed record into the returned symlink string. The attacker reads that symlink value from user space and obtains a small disclosure of adjacent kernel memory. Repeated attempts with controlled image layouts may improve the usefulness of the leaked data.

How to fix it

Upgrade the Linux kernel to a version that includes the fix for bounded Rock Ridge SL record parsing in the isofs driver. If distribution-specific fixed versions are not yet identified, apply the latest security kernel update from the operating system vendor and reboot into the updated kernel. As interim mitigations, disable automatic mounting of removable media and ISO images, restrict who can mount loopback or removable ISO files, avoid processing untrusted ISO images on sensitive systems, and perform ISO inspection in isolated sandbox environments. Where feasible, block or limit use of the ISO 9660 filesystem module on systems that do not require it, recognizing this may affect legitimate CD/DVD, virtual media, and image-processing workflows.

How to confirm the fix worked

Confirm the running kernel includes the vendor fix, not merely that the package is installed. Validate by checking the active kernel version after reboot against the distribution advisory or fixed package changelog. Review whether automatic mounting services such as udisks2 are enabled on desktops and whether users can trigger ISO mounts through file managers, loop devices, virtualization tools, or removable media workflows. For defense-in-depth validation, attempt to mount and read metadata from a malformed test ISO in a controlled lab; fixed kernels should reject malformed symbolic-link components and fail safely rather than returning leaked bytes. Also verify that removable-media and ISO-handling policies are enforced as intended.

Typical attack path

1. Create a malicious ISO 9660 image with Rock Ridge extensions enabled.
2. Embed a crafted SL symbolic-link record whose component length extends beyond the SL record boundary.
3. Optionally place the malformed record in a continuation area near the end of an allocation to increase the chance of reading adjacent kernel memory.
4. Deliver the ISO through removable media, a downloaded disk image, virtual CD/DVD media, or another workflow that causes the target to mount or inspect it.
5. Trigger kernel parsing of the affected Rock Ridge metadata by listing files, resolving metadata, or reading the crafted symlink.
6. Call or induce readlink() on the crafted symlink and collect the returned symlink target containing leaked kernel memory bytes.

How to detect it

There are no reliable exploit-specific indicators for this vulnerability because successful exploitation may only return leaked memory through normal filesystem operations without creating distinctive logs. Investigators should focus on exposure and suspicious mounting activity. Review system logs, auditd, endpoint telemetry, udisks2 logs, kernel logs, shell history, file manager activity, and EDR file events for ISO 9660 images mounted from untrusted locations such as removable media, downloads, email attachments, temporary directories, shared folders, or user-upload paths. Look for sequences where an ISO is mounted and then symlinks inside it are enumerated or read using tools such as readlink, find, ls, file managers, archive/indexing tools, malware sandboxes, or custom parsers. On Linux desktops, examine udisksd/udisks2 activity around removable media insertion and loop-mounted ISO files. On servers, review mount, losetup, systemd-mount, guestmount, container, virtualization, and backup/forensic tooling logs. Treat any unexpected ISO mount followed by scripted metadata traversal as suspicious, but absence of logs does not rule out exploitation.

What your security team should do

• Prioritize kernel updates for desktops, workstations, kiosks, analysis systems, and any servers that mount user-supplied ISO images or removable media.
• Reboot systems after applying the fixed kernel and verify the patched kernel is the one currently running.
• Temporarily disable automount for removable media and downloaded disk images where operationally feasible.
• Restrict ISO mounting and loop-device access to trusted administrators or isolated processing services.
• Route untrusted disk images through sandboxed analysis environments rather than mounting them on production or privileged workstations.
• Monitor for unusual ISO 9660 mounts, especially from removable media, user download directories, email attachments, browser caches, or shared upload locations.
• Educate help desk, desktop support, and analysis teams not to mount unsolicited ISO files on sensitive systems.
• Track vendor advisories for exact fixed kernel package versions because upstream kernel fixes are commonly backported under distribution-specific version numbers.