In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk()… (CVE-2026-64317)

The Linux kernel's isofs module contained a vulnerability (CVE-2026-64317) in handling Rock Ridge symbolic link (SL) records. The functions get_symlink_chunk() and parse_rock_ridge_inode_internal() iterate over variable-length SL components, each with a two-byte header and a text field. Neither function checked that the declared length of each component stayed within the SL record boundary. An attacker-controlled SL record with a component length extending beyond the record triggers an out-of-bounds read of up to 255 bytes. When the SL record is at the end of its backing buffer, this read crosses allocation boundaries, causing get_symlink_chunk() to copy out-of-bounds kernel memory into the symlink body returned to user space by readlink(). Since ISO 9660 images are often auto-mounted from untrusted media without administrative privileges, this can lead to kernel memory disclosure. The vulnerability was fixed by adding bounds checks to reject components that do not fit within the remaining SL record bytes, causing readlink() to fail with -EIO on malformed records.

This vulnerability allows a local attacker with the ability to mount crafted ISO 9660 images to cause an out-of-bounds read in kernel memory. The out-of-bounds data is copied into the symlink target returned by readlink(), potentially disclosing sensitive adjacent kernel memory to user space. The impact is confidentiality loss of kernel memory contents. There is no indication of integrity or availability impact beyond the readlink() failure. The vulnerability is exploitable without elevated privileges due to auto-mounting of removable media in desktop environments.

A fix has been implemented in the Linux kernel isofs module to properly validate Rock Ridge SL components, rejecting any that exceed the SL record boundaries. This causes readlink() to fail safely rather than leak kernel memory. Users should apply the official Linux kernel updates that include this fix. Since no explicit patch links or vendor advisories are provided, check the vendor or kernel mailing list for the relevant fixed kernel versions. Until patched, avoid mounting untrusted ISO 9660 images or disable auto-mounting of removable media if possible.