CVE-2026-64317

A flaw was found in the Linux kernel's ISO 9660 file system (isofs) component. A local attacker could exploit this vulnerability by providing a specially crafted ISO 9660 image containing a malformed Rock Ridge symbolic link record. This flaw allows for an out-of-bounds read, leading to the disclosure of sensitive kernel memory information. This can occur when the crafted image is mounted, potentially without requiring elevated privileges.

This issue is triggered by a specially crafted disk image containing on-disk metadata inconsistencies. Exploitation requires that an attacker convince a user to download and use a malicious image from an untrusted source, a scenario with limited practical impact. Red Hat rates this as Low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.