CVE-2026-46124

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-46124

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46124.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-46124

Downstream

AZL (1)

AZL-88947

BELL (1)

BELL-CVE-2026-46124

DEBIAN (1)

DEBIAN-CVE-2026-46124

ECHO (1)

ECHO-d6f7-037a-cf13

openSUSE (2)

ROOT (4)

SUSE (11)

UBUNTU (1)

Related

openSUSE (2)

SUSE (11)

Published

2026-05-28T09:35:38Z

Modified

2026-10-17T02:30:41Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

isofs: validate block number from NFS file handle in isofs_export_iget

Details

In the Linux kernel, the following vulnerability has been resolved:

isofs: validate block number from NFS file handle in isofs_export_iget

isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780.

sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix.

Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line.

Database specific

{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46124.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5e7de55602c61c8ff28db075cc49c8dd6989d7e0

Fixed

ee0024f5a7e3c73aa253869fae9650ae054093ca

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

63d5a3e207bf315a32c7d16de6c89753a759f95a

Fixed

31dbb4ba0f719ae7774e4c0c95172c9bf81692f5

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

0fdafdaef796816a9ed0fd7ac812932d569d9beb

Fixed

908a76f0b1038035e6ebb4f2293ce079f92e0a02

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

952e7a7e317f126d0a2b879fc531b716932d5ffa

Fixed

bb0988ed4f2e26d59bbb58f644cb3a55b7521e21

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

56dfffea9fd3be0b3795a9ca6401e133a8427e0b

Fixed

0a1af74ae2177bda3aee0837a0546309aa539d0d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

0405d4b63d082861f4eaff9d39c78ee9dc34f845

Fixed

afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b

Fixed

4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6

Fixed

24376458138387fb251e782e624c7776e9826796

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.10.237

Fixed

5.10.258

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.181

Fixed

5.15.209

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.135

Fixed

6.1.175

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.88

Fixed

6.6.140

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.12.25

Fixed

6.12.88

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.4.293

Fixed

5.5

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.14.4

Fixed

6.15

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

ee01a309ebf598be1ff8174901ed6e91619f1749

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

007124c896e7d4614ac1f6bd4dedb975c35a2a8e

Affected versions

v5.*

v5.10.237

v5.10.238

v5.10.239

v5.10.240

v5.10.241

v5.10.242

v5.10.243

v5.10.244

v5.10.245

v5.10.246

v5.10.247

v5.10.248

v5.10.249

v5.10.250

v5.10.251

v5.10.252

v5.10.253

v5.10.254

v5.10.255

v5.10.256

v5.10.257

v5.15.181

v5.15.182

v5.15.183

v5.15.184

v5.15.185

v5.15.186

v5.15.187

v5.15.188

v5.15.189

v5.15.190

v5.15.191

v5.15.192

v5.15.193

v5.15.194

v5.15.195

v5.15.196

v5.15.197

v5.15.198

v5.15.199

v5.15.200

v5.15.201

v5.15.202

v5.15.203

v5.15.204

v5.15.205

v5.15.206

v5.15.207

v5.15.208

v5.4.293

v5.4.294

v5.4.295

v5.4.296

v5.4.297

v5.4.298

v5.4.299

v5.4.300

v5.4.301

v5.4.302

v6.*

v6.1.135

v6.1.136

v6.1.137

v6.1.138

v6.1.139

v6.1.140

v6.1.141

v6.1.142

v6.1.143

v6.1.144

v6.1.145

v6.1.146

v6.1.147

v6.1.148

v6.1.149

v6.1.150

v6.1.151

v6.1.152

v6.1.153

v6.1.154

v6.1.155

v6.1.156

v6.1.157

v6.1.158

v6.1.159

v6.1.160

v6.1.161

v6.1.162

v6.1.163

v6.1.164

v6.1.165

v6.1.166

v6.1.167

v6.1.168

v6.1.169

v6.1.170

v6.1.171

v6.1.172

v6.1.173

v6.1.174

v6.12.25

v6.12.26

v6.12.27

v6.12.28

v6.12.29

v6.12.30

v6.12.31

v6.12.32

v6.12.33

v6.12.34

v6.12.35

v6.12.36

v6.12.37

v6.12.38

v6.12.39

v6.12.40

v6.12.41

v6.12.42

v6.12.43

v6.12.44

v6.12.45

v6.12.46

v6.12.47

v6.12.48

v6.12.49

v6.12.50

v6.12.51

v6.12.52

v6.12.53

v6.12.54

v6.12.55

v6.12.56

v6.12.57

v6.12.58

v6.12.59

v6.12.60

v6.12.61

v6.12.62

v6.12.63

v6.12.64

v6.12.65

v6.12.66

v6.12.67

v6.12.68

v6.12.69

v6.12.70

v6.12.71

v6.12.72

v6.12.73

v6.12.74

v6.12.75

v6.12.76

v6.12.77

v6.12.78

v6.12.79

v6.12.80

v6.12.81

v6.12.82

v6.12.83

v6.12.84

v6.12.85

v6.12.86

v6.12.87

v6.14.10

v6.14.11

v6.14.4

v6.14.5

v6.14.6

v6.14.7

v6.14.8

v6.14.9

v6.6.100

v6.6.101

v6.6.102

v6.6.103

v6.6.104

v6.6.105

v6.6.106

v6.6.107

v6.6.108

v6.6.109

v6.6.110

v6.6.111

v6.6.112

v6.6.113

v6.6.114

v6.6.115

v6.6.116

v6.6.117

v6.6.118

v6.6.119

v6.6.120

v6.6.121

v6.6.122

v6.6.123

v6.6.124

v6.6.125

v6.6.126

v6.6.127

v6.6.128

v6.6.129

v6.6.130

v6.6.131

v6.6.132

v6.6.133

v6.6.134

v6.6.135

v6.6.136

v6.6.137

v6.6.138

v6.6.139

v6.6.88

v6.6.89

v6.6.90

v6.6.91

v6.6.92

v6.6.93

v6.6.94

v6.6.95

v6.6.96

v6.6.97

v6.6.98

v6.6.99

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46124.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.10.258

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.209

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.175

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.140

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.88

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.30

Type: ECOSYSTEM
Events: Introduced

6.15.0

Fixed

7.0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46124.json"