The isofs subsystem incorrectly processes Rock Ridge symbolic‑link (SL) records: the code that walks the variable‑length components of an SL record refuses to check that each component’s length is contained within the record bounds. A malicious SL can therefore include a component whose length goes past the end of the record. This causes an out‑of‑bounds read of up to 255 bytes, which get_symlink_chunk() copies into the buffer that is later returned to user space by readlink(). The result is that a normal readlink() on a symlink created from such an SL record will leak a block of kernel memory to the calling process, providing an information disclosure channel that does not require elevated privileges. The flaw is independent of the user’s permissions; any process that can mount an ISO image containing a malicious SL record can trigger the disclosure.

All Linux kernel releases that include the isofs filesystem module before the change that adds bounds checking to SL component handling are affected. The vulnerability manifests when a user mounts an ISO 9660 image that contains a malformed Rock Ridge SL record. The exact affected kernel versions are not specified in the report, so any installation of the Linux kernel that does not contain the supporting commit is potentially vulnerable. The advisory includes links to the kernel commit that implements the fix, but no explicit version matrix is provided.

The CVSS score of 7.1 classifies this issue as a high‑severity vulnerability, while the EPSS score is less than 1 %, indicating a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the flaw is trivially exploitable on systems that automatically mount removable media (e.g., via udisks2), which is common in desktop Linux distributions. The attacker only needs to supply a crafted ISO image and subsequently call readlink() on a symlink derived from that image; no kernel privileges or CAP_SYS_ADMIN are required, making the local attack vector broadly available to any user who can mount removable media.