The Linux kernel's isofs module had a vulnerability in the handling of Rock Ridge symbolic link (SL) records. Functions get_symlink_chunk() and parse_rock_ridge_inode_internal() iterate over variable-length SL components without verifying that each component fits within the SL record boundary. A crafted SL record with a component length exceeding the record size triggers an out-of-bounds read of up to 255 bytes. When the SL record is at the end of its backing buffer, this read crosses the allocation boundary, causing get_symlink_chunk() to copy out-of-bounds kernel memory into the symlink body returned to user space by readlink(), resulting in kernel memory disclosure. The vulnerability is exploitable via mounting ISO 9660 images from untrusted media, which desktop environments often auto-mount without elevated privileges. The fix involves rejecting any SL component that does not fit within the remaining record bytes, causing readlink() to fail safely instead of leaking memory.

An attacker controlling the contents of an ISO 9660 image can craft a malformed Rock Ridge SL record that causes the kernel to read and disclose adjacent kernel memory to user space. This memory disclosure could potentially leak sensitive kernel information, which might aid further attacks. The vulnerability is triggered by mounting and reading symbolic links from untrusted ISO 9660 images, a common scenario with removable media. There is no indication of code execution or privilege escalation from this vulnerability alone.

A fix has been implemented in the Linux kernel to add proper bounds checking on Rock Ridge SL components. This prevents out-of-bounds reads and kernel memory disclosure. Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, patching the kernel is the recommended remediation. There is no vendor advisory provided here, so check the Linux kernel mailing lists or distribution security advisories for the official patch and update guidance. Until patched, avoid mounting untrusted ISO 9660 images or use mount options that disable Rock Ridge extensions if possible.