CVE-2026-46124 (GCVE-0-2026-46124)
Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-08-05 12:29
VLAI
EPSS
VEX
Title
isofs: validate block number from NFS file handle in isofs_export_iget
Summary
In the Linux kernel, the following vulnerability has been resolved:
isofs: validate block number from NFS file handle in isofs_export_iget
isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-
controlled block number (ifid->block or ifid->parent_block) from
the NFS file handle to isofs_export_iget(), which only rejects
block == 0 before calling isofs_iget() and ultimately sb_bread().
A crafted file handle with fh_len sufficient to pass the check
added by commit 0405d4b63d08 ("isofs: Prevent the use of too small
fid") can still drive the server to read any in-range block on the
backing device as if it were an iso_directory_record. That earlier
fix was assigned CVE-2025-37780.
sb_bread() on an out-of-range block returns NULL cleanly via the
EIO path, so there is no memory-safety violation. For in-range
reads of adjacent-partition data on the same block device, the
unrelated bytes end up in iso_inode_info fields that reach the NFS
client as dentry metadata. The deployment surface (isofs exported
over NFS from loop-mounted images) is narrow and requires an
authenticated NFS peer, but the malformed-file-handle class is
reportable as hardening next to the existing CVE-2025-37780 fix.
Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so
the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()
call sites with a single line.
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
5e7de55602c61c8ff28db075cc49c8dd6989d7e0 , < ee0024f5a7e3c73aa253869fae9650ae054093ca
(git)
Affected: 63d5a3e207bf315a32c7d16de6c89753a759f95a , < 31dbb4ba0f719ae7774e4c0c95172c9bf81692f5 (git) Affected: 0fdafdaef796816a9ed0fd7ac812932d569d9beb , < 908a76f0b1038035e6ebb4f2293ce079f92e0a02 (git) Affected: 952e7a7e317f126d0a2b879fc531b716932d5ffa , < bb0988ed4f2e26d59bbb58f644cb3a55b7521e21 (git) Affected: 56dfffea9fd3be0b3795a9ca6401e133a8427e0b , < 0a1af74ae2177bda3aee0837a0546309aa539d0d (git) Affected: 0405d4b63d082861f4eaff9d39c78ee9dc34f845 , < afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b (git) Affected: 0405d4b63d082861f4eaff9d39c78ee9dc34f845 , < 4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6 (git) Affected: 0405d4b63d082861f4eaff9d39c78ee9dc34f845 , < 24376458138387fb251e782e624c7776e9826796 (git) Affected: ee01a309ebf598be1ff8174901ed6e91619f1749 (git) Affected: 007124c896e7d4614ac1f6bd4dedb975c35a2a8e (git) Affected: 5.10.237 , < 5.10.258 (semver) Affected: 5.15.181 , < 5.15.209 (semver) Affected: 6.1.135 , < 6.1.175 (semver) Affected: 6.6.88 , < 6.6.140 (semver) Affected: 6.12.25 , < 6.12.88 (semver) Affected: 5.4.293 , < 5.5 (semver) Affected: 6.14.4 , < 6.15 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/isofs/export.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee0024f5a7e3c73aa253869fae9650ae054093ca",
"status": "affected",
"version": "5e7de55602c61c8ff28db075cc49c8dd6989d7e0",
"versionType": "git"
},
{
"lessThan": "31dbb4ba0f719ae7774e4c0c95172c9bf81692f5",
"status": "affected",
"version": "63d5a3e207bf315a32c7d16de6c89753a759f95a",
"versionType": "git"
},
{
"lessThan": "908a76f0b1038035e6ebb4f2293ce079f92e0a02",
"status": "affected",
"version": "0fdafdaef796816a9ed0fd7ac812932d569d9beb",
"versionType": "git"
},
{
"lessThan": "bb0988ed4f2e26d59bbb58f644cb3a55b7521e21",
"status": "affected",
"version": "952e7a7e317f126d0a2b879fc531b716932d5ffa",
"versionType": "git"
},
{
"lessThan": "0a1af74ae2177bda3aee0837a0546309aa539d0d",
"status": "affected",
"version": "56dfffea9fd3be0b3795a9ca6401e133a8427e0b",
"versionType": "git"
},
{
"lessThan": "afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"lessThan": "4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"lessThan": "24376458138387fb251e782e624c7776e9826796",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"status": "affected",
"version": "ee01a309ebf598be1ff8174901ed6e91619f1749",
"versionType": "git"
},
{
"status": "affected",
"version": "007124c896e7d4614ac1f6bd4dedb975c35a2a8e",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.25",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/isofs/export.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate block number from NFS file handle in isofs_export_iget\n\nisofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-\ncontrolled block number (ifid-\u003eblock or ifid-\u003eparent_block) from\nthe NFS file handle to isofs_export_iget(), which only rejects\nblock == 0 before calling isofs_iget() and ultimately sb_bread().\nA crafted file handle with fh_len sufficient to pass the check\nadded by commit 0405d4b63d08 (\"isofs: Prevent the use of too small\nfid\") can still drive the server to read any in-range block on the\nbacking device as if it were an iso_directory_record. That earlier\nfix was assigned CVE-2025-37780.\n\nsb_bread() on an out-of-range block returns NULL cleanly via the\nEIO path, so there is no memory-safety violation. For in-range\nreads of adjacent-partition data on the same block device, the\nunrelated bytes end up in iso_inode_info fields that reach the NFS\nclient as dentry metadata. The deployment surface (isofs exported\nover NFS from loop-mounted images) is narrow and requires an\nauthenticated NFS peer, but the malformed-file-handle class is\nreportable as hardening next to the existing CVE-2025-37780 fix.\n\nReject block \u003e= ISOFS_SB(sb)-\u003es_nzones in isofs_export_iget() so\nthe check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()\ncall sites with a single line."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached when nfsd decodes an attacker-supplied NFS file handle (exportfs_decode_fh \u2192 isofs_fh_to_dentry), so a remote NFS client triggers it over the network (TCP/UDP 2049).\nAC:L - The attacker fully controls the block field in the file handle and the read is deterministic; no race or uncontrollable memory layout is involved.\nPR:N - The decode runs before per-user permission checks, and the realistic deployment (a read-only ISO exported to a subnet via default AUTH_SYS) lets any permitted network peer craft handles without credentials.\nUI:N - The NFS server processes the crafted request automatically; no victim action is required at attack time beyond the pre-existing export.\nS:U - The impact stays within the kernel filesystem/NFS security authority; no cross-authority boundary (VM, IOMMU, sandbox) is crossed.\nC:H - An out-of-bounds (cross-partition) read of arbitrary in-range blocks on the backing device is disclosed to the NFS client as inode metadata, and is not bounded to a few bytes since the attacker can probe blocks across the device.\nI:N - isofs is mounted strictly read-only and the commit confirms no memory-safety violation, so the attacker cannot modify any data or kernel memory.\nA:N - Out-of-range reads return NULL cleanly via the EIO path and in-range parsing is bounded; the commit and maintainer explicitly confirm no crash, hang, or memory-safety fault."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:53.831Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca"
},
{
"url": "https://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5"
},
{
"url": "https://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02"
},
{
"url": "https://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21"
},
{
"url": "https://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d"
},
{
"url": "https://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b"
},
{
"url": "https://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6"
},
{
"url": "https://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796"
}
],
"title": "isofs: validate block number from NFS file handle in isofs_export_iget",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46124",
"datePublished": "2026-05-28T09:35:38.887Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-05T12:29:53.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-46124",
"date": "2026-09-30",
"epss": "0.00579",
"percentile": "0.45588"
},
"microsoft_vex": {
"current_release_date": "2026-06-09T14:44:20.000Z",
"cve": "CVE-2026-46124",
"id": "msrc_CVE-2026-46124",
"initial_release_date": "2026-05-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "isofs: validate block number from NFS file handle in isofs_export_iget",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46124.json",
"version": "3"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/isofs/export.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee0024f5a7e3c73aa253869fae9650ae054093ca",
"status": "affected",
"version": "5e7de55602c61c8ff28db075cc49c8dd6989d7e0",
"versionType": "git"
},
{
"lessThan": "31dbb4ba0f719ae7774e4c0c95172c9bf81692f5",
"status": "affected",
"version": "63d5a3e207bf315a32c7d16de6c89753a759f95a",
"versionType": "git"
},
{
"lessThan": "908a76f0b1038035e6ebb4f2293ce079f92e0a02",
"status": "affected",
"version": "0fdafdaef796816a9ed0fd7ac812932d569d9beb",
"versionType": "git"
},
{
"lessThan": "bb0988ed4f2e26d59bbb58f644cb3a55b7521e21",
"status": "affected",
"version": "952e7a7e317f126d0a2b879fc531b716932d5ffa",
"versionType": "git"
},
{
"lessThan": "0a1af74ae2177bda3aee0837a0546309aa539d0d",
"status": "affected",
"version": "56dfffea9fd3be0b3795a9ca6401e133a8427e0b",
"versionType": "git"
},
{
"lessThan": "afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"lessThan": "4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"lessThan": "24376458138387fb251e782e624c7776e9826796",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"status": "affected",
"version": "ee01a309ebf598be1ff8174901ed6e91619f1749",
"versionType": "git"
},
{
"status": "affected",
"version": "007124c896e7d4614ac1f6bd4dedb975c35a2a8e",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.25",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/isofs/export.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4D6F83CA-7E5C-4A91-9D8C-71CC85535E7D",
"versionEndExcluding": "5.5",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D8832159-E9F2-4E3A-869E-F397B4D75488",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "319819D2-533D-4AE6-8CE2-84C6808BA7CB",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AB26E4C3-EF6C-4A53-AD49-F12E5001AEFB",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78409D7B-A51C-439C-AF2E-F5FAF6F02BDC",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AAED5477-21D0-4771-AF56-C4AC881021BC",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "786E593C-5048-4AE0-9421-71BE44AB6058",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.14.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5E3FC740-6BC4-42A2-9F5A-712E2A27869A",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.15.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*",
"matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
"matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
"matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
"matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
"matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*",
"matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate block number from NFS file handle in isofs_export_iget\n\nisofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-\ncontrolled block number (ifid-\u003eblock or ifid-\u003eparent_block) from\nthe NFS file handle to isofs_export_iget(), which only rejects\nblock == 0 before calling isofs_iget() and ultimately sb_bread().\nA crafted file handle with fh_len sufficient to pass the check\nadded by commit 0405d4b63d08 (\"isofs: Prevent the use of too small\nfid\") can still drive the server to read any in-range block on the\nbacking device as if it were an iso_directory_record. That earlier\nfix was assigned CVE-2025-37780.\n\nsb_bread() on an out-of-range block returns NULL cleanly via the\nEIO path, so there is no memory-safety violation. For in-range\nreads of adjacent-partition data on the same block device, the\nunrelated bytes end up in iso_inode_info fields that reach the NFS\nclient as dentry metadata. The deployment surface (isofs exported\nover NFS from loop-mounted images) is narrow and requires an\nauthenticated NFS peer, but the malformed-file-handle class is\nreportable as hardening next to the existing CVE-2025-37780 fix.\n\nReject block \u003e= ISOFS_SB(sb)-\u003es_nzones in isofs_export_iget() so\nthe check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()\ncall sites with a single line."
}
],
"id": "CVE-2026-46124",
"lastModified": "2026-06-24T16:51:14.923",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-05-28T10:16:27.920",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Undergoing Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "None",
"current_release_date": "2026-06-28T11:16:06+00:00",
"cve": "CVE-2026-46124",
"id": "CVE-2026-46124",
"initial_release_date": "2026-05-28T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: isofs: validate block number from NFS file handle in isofs_export_iget",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46124.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-11T01:12:12Z",
"cve": "CVE-2026-46124",
"id": "CVE-2026-46124",
"initial_release_date": "2026-05-29T01:16:47Z",
"product_status:first_fixed": "2",
"product_status:known_affected": "424",
"product_status:known_not_affected": "219",
"product_status:recommended": "318",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-46124",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46124.json",
"version": "16"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…