CVE-2021-47478
A flaw in the Linux kernel’s isofs file system can let a corrupted ISO image cause the kernel to read memory beyond the intended buffer. This can expose sensitive data or crash the system. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux systems that use the kernel’s isofs module, including most distributions that support mounting ISO images. Any system running a kernel version before the patch is vulnerable.
Real-world impact
An attacker could craft a malicious ISO image that, when mounted, causes the kernel to read data outside the intended bounds, potentially leaking confidential information or destabilizing the system.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability can compromise confidentiality and availability with no authentication or user interaction required. The attacker can read arbitrary data and crash the system, making it a critical risk.
What to do about it
- 01Update the Linux kernel to a version that includes the isofs patch.
NVD-referenced vendor advisory
Timeline
- May 22, 2024 · May 22, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/156ce5bb6cc43a80a7…patch
- git.kernel.org/stable/c/6e80e9314f8bb52d9e…patch
- git.kernel.org/stable/c/86d4aedcbc69c0f845…patch
- git.kernel.org/stable/c/9ec33a9b8790c212cc…patch
- git.kernel.org/stable/c/afbd40f425227e661d…patch
- git.kernel.org/stable/c/b0ddff8d68f2e43857…patch
- git.kernel.org/stable/c/b2fa1f52d22c545521…patch
- git.kernel.org/stable/c/e7fb722586a2936b37…patch
- git.kernel.org/stable/c/e96a1866b40570b595…patch