CVE-2026-46303

A flaw was found in the Linux kernel's isofs filesystem. This vulnerability allows a local attacker, by mounting a specially crafted ISO image, to read data beyond the boundaries of the intended ISO 9660 volume. This out-of-bounds read could lead to information disclosure, potentially exposing sensitive data from adjacent filesystems on the same block device.

This Moderate flaw in the Linux kernel's isofs filesystem allows a local attacker to disclose information. Exploitation requires local access and the ability to mount a specially crafted ISO image, which could occur via CAP_SYS_ADMIN or through desktop auto-mount features like udisks2. This could expose sensitive data from adjacent filesystems on the same block device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure, restrict the ability of untrusted users to mount ISO images. If the isofs kernel module is not essential for system operation, it can be prevented from loading. To blacklist the isofs module:

1. Create or edit /etc/modprobe.d/blacklist-isofs.conf and add:

   blacklist isofs
   install isofs /bin/true
   

2. Regenerate the initramfs to apply the change:

   dracut -f -v
   

3. A system reboot is required for this change to take full effect. This action may affect functionality requiring ISO 9660 filesystem mounts.