A flaw in the Linux kernel’s isofs implementation allows an attacker to supply a crafted NFS file handle containing an arbitrary block number. The kernel fails to enforce bounds validation beyond a check for block==0, so the exported NFS server can read any block that exists on the backing device as if it were an ISO directory record. The read is performed through sb_bread, which returns NULL cleanly for out-of-range blocks; however, for in-range reads that cross partition boundaries the data returned can contain unrelated bytes from adjacent partitions. These bytes are propagated back to the NFS client as dentry metadata, providing a covert channel for leaking data. The vulnerability does not lead to a memory safety issue or code execution; its impact is limited to information disclosure to an authenticated NFS peer. Because the surface area is narrow – an authenticated NFS client interacting with loop-mounted ISO images – the risk is low to moderate, but the flaw is considered hardening related and warrants remediation.

Linux kernel (all versions prior to the fix that added bounds validation in isofs_export_iget). The vulnerability affects systems running a kernel that includes the isofs filesystem and exports it over NFS using loop-mounted ISO images. No specific release series is listed; all affected kernel releases should be updated to a patched version once available.

The exploit requires an authenticated NFS client manipulating file handles. No publicly available exploitation path involves attacker privileges beyond that, and the EPSS score is currently not available. The flaw is not listed in CISA’s KEV catalog, and no memory corruption or direct code execution is possible. The CVSS score is not supplied; the consequence remains information disclosure of partition data rather than system compromise.