CVE-2026-64317 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
isofs: bound Rock Ridge symlink components to the SL record
get_symlink_chunk() and the SL handling in parse_rock_ridge_inode_internal() walk the variable-length components of a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte header (flags, len) followed by len bytes of text, so it occupies slp->len + 2 bytes. Both loops read slp->len and advance to the next component, and get_symlink_chunk() additionally does memcpy(rpnt, slp->text, slp->len), but neither checks that the component lies within the SL record before dereferencing it.
A crafted SL record whose component declares a len that runs past the record (rr->len) therefore triggers an out-of-bounds read of up to 255 bytes. When the record sits at the tail of its backing buffer - for example a small kmalloc()ed continuation block reached through a CE record - the read crosses the allocation; get_symlink_chunk() then copies the out-of-bounds bytes into the symlink body returned to user space by readlink(), disclosing adjacent kernel memory.
ISO 9660 images are routinely mounted from untrusted removable media - desktop environments auto-mount them (e.g. via udisks2) without CAP_SYS_ADMIN - so the record contents are attacker-controlled.
Reject any component that does not fit in the remaining record bytes before using it. In get_symlink_chunk() return NULL, like the existing output-buffer (plimit) checks, so a malformed record makes readlink() fail with -EIO rather than silently returning a truncated target; in parse_rock_ridge_inode_internal() stop the inode-size walk.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical out-of-bounds read condition within the Linux kernel's ISO filesystem implementation, specifically affecting the handling of Rock Ridge symbolic link records. This flaw exists in the isofs subsystem where the kernel processes ISO 9660 filesystems with Rock Ridge extensions, which are commonly used for CD-ROM and DVD media compatibility. The issue stems from insufficient validation of variable-length components within the SL (symbolic link) record structure, creating a path for malicious data to trigger memory access violations.
The technical implementation flaw occurs in two primary functions: get_symlink_chunk() and parse_rock_ridge_inode_internal(). Both routines process Rock Ridge SL records without proper bounds checking on component lengths. Each SL record component consists of a two-byte header containing flags and length information, followed by the actual text content. The vulnerability manifests when a crafted SL record contains a component length value that extends beyond the actual record boundaries defined by rr->len. This allows attackers to read up to 255 bytes of adjacent kernel memory, as the code performs direct memory copies without validating component offsets against available buffer space.
The operational impact of this vulnerability is severe given the widespread use of ISO filesystems and automatic mounting mechanisms. Desktop environments typically auto-mount removable media through systems like udisks2 without requiring privileged capabilities, making user-space applications vulnerable to exploitation. When an attacker crafts a malicious ISO image with malformed SL records, they can trigger kernel memory disclosure during readlink() system calls, potentially exposing sensitive kernel data structures, cryptographic keys, or other confidential information. This represents a classic information disclosure vulnerability that aligns with CWE-129: Improper Validation of Array Index and CWE-787: Out-of-bounds Write.
The exploitation scenario becomes particularly dangerous when considering the typical memory layout and allocation patterns. When SL records are positioned at the tail of backing buffers, such as small kmalloc()ed continuation blocks accessed through CE (Continuation Area) records, the out-of-bounds read crosses allocation boundaries. This cross-allocation access pattern increases the potential for disclosing kernel memory contents that may include sensitive data from adjacent allocations. The vulnerability operates under ATT&CK technique T1059.007: Command and Scripting Interpreter: Python, as attackers can craft ISO images with malicious SL records to trigger the vulnerable code paths.
The recommended mitigation strategy involves implementing strict bounds checking before processing any SL record component data. In get_symlink_chunk(), the implementation should validate that each component fits within the remaining record bytes before performing any memory operations, returning NULL similar to existing buffer overflow checks to ensure readlink() fails gracefully with -EIO rather than silently truncating results. The parse_rock_ridge_inode_internal() function must also halt the inode-size calculation when malformed components are detected, preventing further processing of corrupted data structures. This approach aligns with security best practices for defensive programming and prevents exploitation while maintaining filesystem compatibility for legitimate use cases.