The vulnerability arises in the Linux kernel's ISO 9660 file system support, where the Rock Ridge continuation extent value is read from an ISO image without validating that the block number is within the bounds of the mounted volume. The unchecked block number can cause the kernel to read data from any location on the underlying block device, including areas belonging to a different filesystem. The data read is interpreted as Rock Ridge records, and only the text of SL sub‑records is then made reachable through readlink(2). This allows a narrow information‑leak channel that could reveal filenames or other string data outside the protected ISO image.

All systems running a Linux kernel that includes the isofs module before the fixes in commits e595447e177b and f54e18f1b831 are potentially vulnerable. The exact kernel version range was not specified in the advisory, so any kernel with the isofs driver and no subsequent patch is at risk until an updated kernel or module is installed.

There is no memory‑safety issue or privilege escalation path; the only effect is a potential leakage of strings from a neighboring filesystem if the malicious ISO is mounted. The acceptable block read that fails cleanly returns NULL via the block layer, so no kernel crash occurs. The CVSS score is not provided and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. An attacker would need the ability to mount a crafted ISO image, either through the automatic udisks2 mount or by executing a mount command with CAP_SYS_ADMIN. Because the data exposed is limited and requires privileged access or user interaction, the practical risk is relatively low.