The Linux kernel's ISO 9660 (isofs) module incorrectly accepts a Rock Ridge continuation extent value from the image without validating that the block number lies inside the mounted volume. This oversight allows the kernel to read from arbitrary blocks on the same block device, potentially from another filesystem. The data is parsed as Rock Ridge records, but only the textual contents of matching SL sub‑records are exposed through readlink(2), causing a narrow information‑leak channel that could reveal filenames or other strings outside the ISO.

All Linux systems that run a kernel containing the isofs driver before the application of the fix in the two commits are exposed. The advisory does not specify exact kernel versions, so any system with an unpatched isofs module is potentially vulnerable until it upgrades to a kernel that includes the bounds‑check patch.

The vulnerability has no memory safety or privilege escalation defect; the only impact is the limited leakage of text. An attacker would need to mount a crafted ISO image, which requires either interaction with an automatic udisks2 mount or execution of a mount command with CAP_SYS_ADMIN. The CVSS score of 8.2 indicates high severity, but the EPSS score of < 1% shows a very low expected exploitation probability, and it is not listed in CISA's KEV catalog. The risk is therefore considered high in theory but limited in practice to environments that scan the device for mountable media or allow untrusted users to mount filesystems.