Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46303

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block num
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:94475db969896d29ea4999a3b2749743457b7460e6faa50fe5f98b3983bcd5b8
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/isofs/rock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8356fb821016797f5677cbeee5ddc0d32a95b4be","status":"affected","version":"f54e18f1b831c92f6512d2eedb224cd63d607d3d","versionType":"git"},{"lessThan":"d582e12378bc1637f337622feef762f53c43fd57","status":"affected","version":"f54e18f1b831c92f6512d2eedb224cd63d607d3d","versionType":"git"},{"lessThan":"bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9","status":"affected","version":"f54e18f1b831c92f6512d2eedb224c…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/isofs/rock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqu…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/isofs/rock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8356fb821016797f5677cbeee5ddc0d32a95b4be","status":"affected","version":"f54e18f1b831c92f6512d2eedb224cd63d607d3d","versionType":"git"},{"lessThan":"d582e12378bc1637f337622feef762f53c43fd57","status":"affected","version":"f54e18f1b831c92f6512d2eedb224cd63d607d3d","versionType":"git"},{"lessThan":"bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9","status":"affected","version":"f54e18f1b831c92f6512d2eedb224c…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["fs/isofs/rock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqu…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/22b36fa081f38ab397c7697f9d539211b51a0cfc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/8356fb821016797f5677cbeee5ddc0d32a95b4be"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/a36d990f591320e9dd379ab30063ebfe91d47e1f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/bf1bc673c587f5ef7e9c09b94aea7c5a7847d4d9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/c9b37c8b73f6368e4750e5ccb0632c380b43c6e5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/d582e12378bc1637f337622feef762f53c43fd57"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/e69da8eeab74b4f4505024c38a17bce060fe7df8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/ef048470c90bc8c1b8318bb2ce329da9ef64b9fe"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a0e0df06ef24bc9e77744ffe79d07978e4e5c74795da7139cbf053fa616244d6 · sha256:83e5a1b2b369f803… · /containers/cna/references/6

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer