CVE-2026-46124

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

isofs: validate block number from NFS file handle in isofs_export_iget

isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-

controlled block number (ifid->block or ifid->parent_block) from

the NFS file handle to isofs_export_iget(), which only rejects

block == 0 before calling isofs_iget() and ultimately sb_bread().

A crafted file handle with fh_len sufficient to pass the check

added by commit 0405d4b63d08 ("isofs: Prevent the use of too small

fid") can still drive the server to read any in-range block on the

backing device as if it were an iso_directory_record. That earlier

fix was assigned CVE-2025-37780.

sb_bread() on an out-of-range block returns NULL cleanly via the

EIO path, so there is no memory-safety violation. For in-range

reads of adjacent-partition data on the same block device, the

unrelated bytes end up in iso_inode_info fields that reach the NFS

client as dentry metadata. The deployment

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References