CVE-2026-64317: Linux Kernel Information Disclosure Flaw

CVE-2026-64317 Overview

CVE-2026-64317 is an out-of-bounds read vulnerability in the Linux kernel's isofs filesystem driver, specifically in the Rock Ridge extension's symbolic link (SL) record parsing. The functions get_symlink_chunk() and parse_rock_ridge_inode_internal() walk variable-length SL components without verifying that each component fits within the containing record. A crafted ISO 9660 image can trigger a read of up to 255 bytes beyond the record boundary, disclosing adjacent kernel memory to userspace via readlink().

Critical Impact
Attackers with local access to mount an untrusted ISO 9660 image can leak kernel memory contents through crafted Rock Ridge symlink records, bypassing kernel address space protections.

Affected Products

Linux kernel (multiple stable branches referenced by the upstream patches)
Distributions shipping the isofs module with Rock Ridge support enabled
Desktop systems using udisks2 or similar auto-mount services for removable media

Discovery Timeline

2026-07-25 - CVE-2026-64317 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64317

Vulnerability Analysis

The vulnerability resides in the Linux kernel's fs/isofs/rock.c handling of Rock Ridge SL (symbolic link) records. Each SL record contains a sequence of variable-length components. Every component begins with a two-byte header composed of a flags byte and a length byte (slp->len), followed by slp->len bytes of link text. The total component size is therefore slp->len + 2 bytes.

Both get_symlink_chunk() and the SL branch of parse_rock_ridge_inode_internal() iterate through these components and advance based on slp->len. Neither loop validates that the current component lies fully within the enclosing SL record (rr->len) before dereferencing slp->text or advancing the pointer.

When get_symlink_chunk() executes memcpy(rpnt, slp->text, slp->len) on a component whose declared length overruns the record, it copies out-of-bounds bytes into the symlink buffer. That buffer is subsequently returned to userspace through the readlink() system call, exposing whatever kernel memory sits adjacent to the SL record.

Root Cause

The root cause is missing bounds validation on attacker-controlled length fields parsed from on-disk metadata [CWE-125: Out-of-Bounds Read]. The parser trusts slp->len without confirming that component_offset + 2 + slp->len <= rr->len. When the SL record sits at the tail of a small kmalloc()-backed continuation buffer reached via a CE (continuation) record, the over-read crosses the slab allocation into unrelated kernel data.

Attack Vector

Exploitation requires local access sufficient to trigger a mount of an attacker-crafted ISO 9660 image. On modern desktop distributions, udisks2 and similar services auto-mount removable media without requiring CAP_SYS_ADMIN, effectively lowering the bar to physical or interactive-session access. An attacker supplies an ISO image whose Rock Ridge SL record contains a component declaring a len that runs past the record boundary. When the mounted filesystem is traversed and readlink() is invoked on the crafted symlink, the kernel returns a link target containing leaked adjacent memory. Repeated crafting can be used to probe slab neighbors and disclose sensitive kernel state, including pointers useful for defeating KASLR.

No verified public exploit code is available. The upstream patches (1015e1c, 36fe7d2, 5fa1d6a, 6bf41db, 9830725, a22cb6b, b569964, b736b12) reject any component that does not fit in the remaining record bytes, causing readlink() to fail with -EIO on malformed records instead of silently returning truncated, memory-tainted targets.

Detection Methods for CVE-2026-64317

Indicators of Compromise

Unexpected mount events for ISO 9660 (iso9660) filesystems from removable devices or loop-mounted image files in user sessions.
readlink() or readlinkat() syscalls against paths on freshly mounted ISO images returning symlink targets that contain non-printable bytes or unusually long payloads.
Kernel log entries from isofs referencing Rock Ridge parsing on user-supplied media.

Detection Strategies

Audit mount syscalls with filesystem type iso9660 originating from non-administrative user contexts, particularly via udisks2 D-Bus activity.
Correlate ISO 9660 mounts with subsequent readlink operations that return payloads exceeding typical symlink lengths or containing binary data.
Monitor for repeated auto-mount and unmount cycles of removable optical or loop devices, which may indicate iterative memory-disclosure probing.

Monitoring Recommendations

Enable Linux Audit (auditd) rules on mount, readlink, and readlinkat syscalls and forward events to a centralized SIEM.
Track the running kernel version across the fleet and flag hosts lagging behind patched stable releases.
Alert on udisks2 policy changes or new .mount units that would broaden auto-mount behavior for untrusted media.

How to Mitigate CVE-2026-64317

Immediate Actions Required

Upgrade to a Linux kernel release that includes the upstream isofs SL bounds check from the stable-tree commits listed in the references.
Restrict or disable auto-mounting of removable and ISO 9660 media in udisks2 and desktop environments on systems handling untrusted images.
Prevent unprivileged users from mounting user-supplied ISO images by tightening polkit rules governing org.freedesktop.udisks2.filesystem-mount.

Patch Information

The fix adds bounds validation that rejects any SL component whose declared length would extend past the enclosing record. In get_symlink_chunk() the function returns NULL on malformed records, aligning with existing plimit checks and causing readlink() to fail with -EIO. In parse_rock_ridge_inode_internal() the inode-size walk stops when an out-of-bounds component is detected. Applicable patches: 1015e1c, 36fe7d2, 5fa1d6a, 6bf41db, 9830725, a22cb6b, b569964, b736b12.

Workarounds

Blacklist the isofs kernel module on systems that do not require ISO 9660 support: add blacklist isofs to /etc/modprobe.d/ and rebuild the initramfs.
Disable udisks2 auto-mount behavior or require administrator authentication for mounting removable filesystems through polkit policy overrides.
Restrict physical and remote-session access on hosts where ISO 9660 support cannot be removed, minimizing opportunities to introduce crafted images.

bash

# Configuration example: disable isofs auto-loading
echo 'blacklist isofs' | sudo tee /etc/modprobe.d/disable-isofs.conf
echo 'install isofs /bin/true' | sudo tee -a /etc/modprobe.d/disable-isofs.conf
sudo update-initramfs -u

# Verify current kernel version against patched stable releases
uname -r