01 Record

CVE-2026-46124

isofs: validate block number from NFS file handle in isofs_export_iget

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

View raw JSON

02 Description

isofs: validate block number from NFS file handle in isofs_export_iget

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.47% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 40.8% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD analysis status

Undergoing Analysis. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-05-28 09:35Z5 MO AGO

Last updated

2026-10-19 19:36Z9 DAYS AGO

Reserved

2026-05-13

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-125Out-of-bounds ReadBase
CWE-1285Improper Validation of Specified Index, Position, or Offset in InputBase

Data version

5.2

Document digest

b173e02d83424c387ca2bae768cee13db1ecac7b311c713739554d6f81e3c6a4

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux5e7de55602c61c8ff28db075cc49c8dd6989d7e0 to < ee0024f5a7e3c73aa253869fae9650ae054093ca, 63d5a3e207bf315a32c7d16de6c89753a759f95a to < 31dbb4ba0f719ae7774e4c0c95172c9bf81692f5, 0fdafdaef796816a9ed0fd7ac812932d569d9beb to < 908a76f0b1038035e6ebb4f2293ce079f92e0a02, 952e7a7e317f126d0a2b879fc531b716932d5ffa to < bb0988ed4f2e26d59bbb58f644cb3a55b7521e21, 56dfffea9fd3be0b3795a9ca6401e133a8427e0b to < 0a1af74ae2177bda3aee0837a0546309aa539d0d, 0405d4b63d082861f4eaff9d39c78ee9dc34f845 to < afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b, 0405d4b63d082861f4eaff9d39c78ee9dc34f845 to < 4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6, 0405d4b63d082861f4eaff9d39c78ee9dc34f845 to < 24376458138387fb251e782e624c7776e9826796, ee01a309ebf598be1ff8174901ed6e91619f1749, 007124c896e7d4614ac1f6bd4dedb975c35a2a8e, 5.10.237 to < 5.10.258, 5.15.181 to < 5.15.209, 6.1.135 to < 6.1.175, 6.6.88 to < 6.6.140, 6.12.25 to < 6.12.88, 5.4.293 to < 5.5, 6.14.4 to < 6.15, 6.15—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca
git.kernel.orghttps://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5
git.kernel.orghttps://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02
git.kernel.orghttps://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21
git.kernel.orghttps://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d
git.kernel.orghttps://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b
git.kernel.orghttps://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6
git.kernel.orghttps://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-784472.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.176-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.88-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.0.7-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.