EUVD-2026-80299
GHSA-vfmj-8pgc-h88m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local mount-and-read trigger (AV:L); auto-mount lets an unprivileged local user supply the image (PR:L); bounded OOB pointer read then deref yields a crash (A:H) with minor leak potential (C:L) and no write (I:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
isofs: fix out-of-bounds page array access on empty zisofs block
zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which "if (poffset && *pages)" reads pages[1] out of bounds. rock.c only rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image.
Return the byte count relative to poffset and zero only [poffset, PAGE_SIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected.
BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofs_read_folio (fs/isofs/compress.c:290) read_pages (mm/readahead.c:184) ... filemap_read (mm/filemap.c:2814) vfs_read (fs/read_write.c:574) __x64_sys_pread64 (fs/read_write.c:769) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
Articles & Coverage 1
AnalysisAI
An out-of-bounds read in the Linux kernel's ISO9660/zisofs decompression code allows a local attacker to read memory past the end of a page-pointer array (kmalloc-8 slab) by simply read()ing a compressed file from a crafted ISO9660 image. The flaw is reachable only when the image's Rock Ridge 'ZF' record specifies a zisofs block-size shift below PAGE_SHIFT (a value rock.c does not reject) and a sub-page block leaves poffset partway into a page followed by an empty block, so the mount prerequisite and local trigger make this a local availability/limited-disclosure bug rather than a remote one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim system to mount a crafted ISO9660 image that uses zisofs compression with a Rock Ridge 'ZF' record whose block-size shift is set below PAGE_SHIFT (so the zisofs block size is below PAGE_SIZE), plus a sub-page block leaving poffset partway into a page followed by an empty block. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is not credible for this bug and directly contradicts the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the upstream isofs zisofs fix and upgrade to a fixed release - 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 or 7.3-rc1 (or any later stable build containing the corresponding backport); the individual commits are linked at https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661, https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48, https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580, https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda, https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa, https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a and https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3, and distribution vendors should be tracked until their kernels carry the backport. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Linux distributions and kernel builds are in use across servers, endpoints, and any host that processes or mounts removable media or customer-supplied ISO images, and temporarily reduce exposure by blocking unprivileged or automatic mounting of untrusted ISO9660 images (for example, disabling the relevant automount helpers, restricting mount privileges to administrators, and where practical blacklisting or disabling the isofs/zisofs modules on high-risk hosts until patched). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today