In the Linux kernel, the isofs driver reads a Rock Ridge continuation extent value from an ISO image without verifying that the block number falls within the bounds of the mounted ISO 9660 volume. This omission allows the kernel to read arbitrary blocks on the same block device, including data belonging to an adjacent filesystem. The read data is parsed as Rock Ridge records, and only the textual contents of certain sub‑records are passed to userspace via readlink(), creating a narrow information‑leak channel. The flaw is an instance of CWE‑125 (Out‑of‑bounds read), and the lack of a bounds check may also lead to increased memory consumption when exploited repeatedly, reflecting CWE‑401. The vulnerability does not provide memory safety or privilege escalation; it solely permits the disclosure of arbitrary text stored beyond the ISO image.

All Linux kernel releases that include the isofs driver but lack the fix from commits e595447e177b and f54e18f1b831. This encompasses every kernel prior to the merge of the bounds‑check patch; the exact version boundary is not published, so any system running a pre‑patched kernel is exposed.

The CVSS score of 8.2 indicates a high‑severity information‑disclosure flaw. The EPSS score of <1% shows a very low expected exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by mounting a specially crafted ISO image, either via automatic udisks2 mounting of optical media in desktop environments or by executing mount with CAP_SYS_ADMIN. Because the exploit only leaks text returned through readlink(), the data window is small, and successful exploitation requires privileged or trusted mount access. Practically, the risk is low in environments that restrict system mount privileges or that disable automatic optical media mounting.