CVE-2026-46124 Overview
CVE-2026-46124 is a Linux kernel vulnerability in the isofs filesystem driver. The flaw exists in isofs_export_iget(), which accepts attacker-controlled block numbers from NFS file handles without validating the upper bound. Both isofs_fh_to_dentry() and isofs_fh_to_parent() pass ifid->block and ifid->parent_block values directly through to sb_bread() after only rejecting block == 0. This vulnerability is reported as a hardening fix adjacent to the earlier CVE-2025-37780 issue affecting the same code path.
Critical Impact
An authenticated NFS peer can craft a file handle that forces the server to read arbitrary in-range blocks from the backing device, leaking adjacent-partition data through iso_inode_info fields exposed as dentry metadata.
Affected Products
- Linux kernel isofs filesystem driver
- Systems exporting isofs (ISO 9660) filesystems over NFS
- Loop-mounted ISO image deployments shared via NFS
Discovery Timeline
- 2026-05-28 - CVE-2026-46124 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46124
Vulnerability Analysis
The vulnerability resides in the NFS export path of the Linux isofs driver. When an NFS client provides a file handle, isofs_fh_to_dentry() and isofs_fh_to_parent() extract a block number from the handle and pass it to isofs_export_iget(). That function only checks whether the block equals zero before calling isofs_iget(), which in turn invokes sb_bread() on the backing block device.
The earlier fix in commit 0405d4b63d08 ("isofs: Prevent the use of too small fid"), assigned CVE-2025-37780, validated only the fh_len field. A crafted handle that satisfies the length check can still specify any block value within the device's addressable range. The result is an information disclosure primitive rather than a memory-safety violation.
Root Cause
The root cause is missing upper-bound validation of an attacker-controlled index [CWE-20]. isofs_export_iget() trusted the block number derived from the NFS file handle without comparing it against ISOFS_SB(sb)->s_nzones, the count of valid zones in the mounted ISO 9660 image.
Attack Vector
An authenticated NFS client crafts a file handle containing an arbitrary block number pointing outside the legitimate ISO 9660 image but within the backing block device. The kernel reads that block and interprets the bytes as an iso_directory_record structure. Fields parsed from this unrelated data populate iso_inode_info and reach the NFS client as dentry metadata. sb_bread() returns NULL cleanly via the EIO path for out-of-range blocks, so the issue is bounded to in-range reads on the same physical device.
The practical attack surface is narrow: it requires isofs exported over NFS, an authenticated NFS peer, and a backing device hosting both the ISO image and other partitions worth reading. Refer to the kernel commit fixing isofs_export_iget for the upstream change.
Detection Methods for CVE-2026-46124
Indicators of Compromise
- NFS server logs showing repeated ESTALE or successful lookups against isofs exports from unexpected client identities.
- Kernel messages from sb_bread() failures or isofs_iget() errors correlated with NFS handle resolution.
- Unusual NFSv3/NFSv4 LOOKUP or READDIR traffic targeting loop-mounted ISO 9660 exports.
Detection Strategies
- Audit running kernel versions against the patched commits listed in the kernel.org references.
- Inspect /proc/mounts and /etc/exports for isofs filesystems exported via NFS and treat them as high-priority patch targets.
- Capture NFS file handles at the wire level and validate that block fields fall within s_nzones for the corresponding export.
Monitoring Recommendations
- Monitor kernel audit logs for repeated isofs read errors originating from NFS daemon contexts.
- Track NFS authentication events and correlate authenticated sessions with isofs export access.
- Alert on creation of new isofs NFS exports outside of change-managed deployment workflows.
How to Mitigate CVE-2026-46124
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry for CVE-2026-46124.
- Inventory all servers exporting isofs filesystems via NFS and prioritize them for kernel updates.
- Restrict NFS access to isofs exports to trusted, authenticated clients on segmented networks.
Patch Information
The fix rejects any block number greater than or equal to ISOFS_SB(sb)->s_nzones inside isofs_export_iget(), covering both isofs_fh_to_dentry() and isofs_fh_to_parent() callers with a single guard. Patched commits are available in the upstream kernel tree, including commit 0a1af74ae217, commit 2437645813838, commit 4c721a1d9b3c, commit afbafeddf23d, and commit bb0988ed4f2e.
Workarounds
- Unexport isofs filesystems from NFS until the kernel patch is applied.
- Restrict NFS exports of ISO 9660 images to read-only access from authenticated clients on dedicated management networks.
- Host loop-mounted ISO images on dedicated block devices to limit what adjacent-partition data could be disclosed.
# Identify isofs mounts currently exported via NFS
mount -t iso9660
exportfs -v | grep -i iso
# Temporarily unexport an isofs share until patches are applied
exportfs -u <client>:/path/to/iso-export
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
