CVE-2026-64317

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

isofs: bound Rock Ridge symlink components to the SL record

get_symlink_chunk() and the SL handling in

parse_rock_ridge_inode_internal() walk the variable-length components of

a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte

header (flags, len) followed by len bytes of text, so it occupies

slp->len + 2 bytes. Both loops read slp->len and advance to the next

component, and get_symlink_chunk() additionally does

memcpy(rpnt, slp->text, slp->len), but neither checks that the component

lies within the SL record before dereferencing it.

A crafted SL record whose component declares a len that runs past the

record (rr->len) therefore triggers an out-of-bounds read of up to 255

bytes. When the record sits at the tail of its backing buffer - for

example a small kmalloc()ed continuation block reached through a CE

record - the read crosses the allocation; get_symlink_chunk() then

copies the out-of-bound

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References