CVE-2021-47478
In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 0.69% probability · 52th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS 0.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7fPatch
- https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe1907698718ff01120f5Patch
- https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7Patch
- https://git.kernel.org/stable/c/9ec33a9b8790c212cc926a88c5e2105f97f3f57ePatch
- https://git.kernel.org/stable/c/afbd40f425227e661d991757e11cc4db024e761fPatch
- https://git.kernel.org/stable/c/b0ddff8d68f2e43857a84dce54c3deab181c8ae1Patch
- https://git.kernel.org/stable/c/b2fa1f52d22c5455217b294629346ad23a744945Patch
- https://git.kernel.org/stable/c/e7fb722586a2936b37bdff096c095c30ca06404dPatch
- https://git.kernel.org/stable/c/e96a1866b40570b5950cda8602c2819189c62a48Patch
- https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7fPatch
- https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe1907698718ff01120f5Patch
- https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7Patch
- https://git.kernel.org/stable/c/9ec33a9b8790c212cc926a88c5e2105f97f3f57ePatch
- https://git.kernel.org/stable/c/afbd40f425227e661d991757e11cc4db024e761fPatch
- https://git.kernel.org/stable/c/b0ddff8d68f2e43857a84dce54c3deab181c8ae1Patch
- https://git.kernel.org/stable/c/b2fa1f52d22c5455217b294629346ad23a744945Patch
- https://git.kernel.org/stable/c/e7fb722586a2936b37bdff096c095c30ca06404dPatch
- https://git.kernel.org/stable/c/e96a1866b40570b5950cda8602c2819189c62a48Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.