High

CVE-2026-46124 — isofs: validate block number from NFS file handle in isofs_export_iget

In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780. sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix. Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line.

Published May 28, 2026 · Updated Oct 14, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.6% (30-day exploitation probability)+7
Technical severity (high)+6

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.58%

ahead of 46% of scored CVEs · Oct 14, 2026

Affects

Linux

Linux and 1 more

CVSS base

7.5

High · 3 source(s)

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux, Linux Linux Kernel).
The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
Apply the fixed version or the patch documented under Remediation.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 5.10.237 and < 5.10.258≥ 0fdafdaef796816a9ed0fd7ac812932d569d9beb and < 908a76f0b1038035e6ebb4f2293ce079f92e0a02≥ 952e7a7e317f126d0a2b879fc531b716932d5ffa and < bb0988ed4f2e26d59bbb58f644cb3a55b7521e21≥ 56dfffea9fd3be0b3795a9ca6401e133a8427e0b and < 0a1af74ae2177bda3aee0837a0546309aa539d0d≥ 0405d4b63d082861f4eaff9d39c78ee9dc34f845 and < afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b≥ 0405d4b63d082861f4eaff9d39c78ee9dc34f845 and < 4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6≥ 0405d4b63d082861f4eaff9d39c78ee9dc34f845 and < 24376458138387fb251e782e624c7776e9826796version ee01a309ebf598be1ff8174901ed6e91619f1749 and 10 more version 007124c896e7d4614ac1f6bd4dedb975c35a2a8e≥ 63d5a3e207bf315a32c7d16de6c89753a759f95a and < 31dbb4ba0f719ae7774e4c0c95172c9bf81692f5≥ 5.15.181 and < 5.15.209≥ 6.1.135 and < 6.1.175≥ 6.6.88 and < 6.6.140≥ 6.12.25 and < 6.12.88≥ 5.4.293 and < 5.5≥ 6.14.4 and < 6.15version 6.15≥ 5e7de55602c61c8ff28db075cc49c8dd6989d7e0 and < ee0024f5a7e3c73aa253869fae9650ae054093ca	Vulnerable	CVE Program (cve.org) e CISA ADP
Linux	Linux Kernel	≥ 5.10.237 and < 5.10.258≥ 5.4.293 and < 5.5≥ 5.15.181 and < 5.15.209≥ 6.1.135 and < 6.1.175≥ 6.6.88 and < 6.6.140≥ 6.12.25 and < 6.12.88≥ 6.14.4 and < 6.15≥ 6.15.1 and < 6.18.30 and 8 more ≥ 6.19 and < 7.0.7version 6.15version 6.15-rc3version 6.15-rc4version 6.15-rc5version 6.15-rc6version 6.15-rc7version 7.1-rc1	Vulnerable	NIST National Vulnerability Database

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
7.5	CVSS 3.1	High	3.9	3.6	416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database
7.5	CVSS 3.1	High	—	—	GitHub, Inc. via GitHub Security Advisories
7.5	CVSS 3.1	High	—	—	Linux via CVE Program (cve.org) e CISA ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)

EPSS over time FIRST

Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 0.58%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).

web/proxy/WAF logsnetwork IDS/IPS

Timeline

What happened to this CVE, newest first.

2026
Affected products added · linux/linux
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 13, 2026
Fix documented
Oct 13, 2026 · NIST National Vulnerability Database
CVSS changed · 7.5
Oct 13, 2026 · NIST National Vulnerability Database
Source status changed · → Undergoing Analysis
Oct 13, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 13, 2026 · NIST National Vulnerability Database
CVE published
May 28, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

2× References added · Oct 14, 2026 – Oct 14, 2026
1× Official description updated · Oct 13, 2026 – Oct 13, 2026

References

11 on the record

git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796
Patch, NIST National Vulnerability Database
github.com/advisories/GHSA-5599-pvjx-q3hc
GitHub Security Advisories
nvd.nist.gov/vuln/detail/CVE-2026-46124
GitHub Security Advisories
cert-portal.siemens.com/productcert/html/ssa-784472.html
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 6h
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 6h
Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-46124 is "isofs: validate block number from NFS file handle in isofs_export_iget", rated High. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.5 describes technical severity. EPSS 0.58% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.