In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk() and the SL handling in parse_rock_ridge_inode_internal() walk the variable-length components of a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte header (flags, len) followed by len bytes of text, so it occupies slp->len + 2 bytes. Both loops read slp->len and advance to the next component, and get_symlink_chunk() additionally does memcpy(rpnt, slp->text, slp->len), but neither checks that the component lies within the SL record before dereferencing it. A crafted SL record whose component declares a len that runs past the record (rr->len) therefore triggers an out-of-bounds read of up to 255 bytes. When the record sits at the tail of its backing buffer - for example a small kmalloc()ed continuation block reached through a CE record - the read crosses the allocation; get_symlink_chunk() then copies the out-of-bound
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64317 is a buffer overflow vulnerability in the Linux kernel's isofs (ISO 9660) filesystem implementation, specifically in the handling of Rock Ridge symbolic link (SL) records. The vulnerability exists in get_symlink_chunk() and parse_rock_ridge_inode_internal() functions, which fail to properly bound variable-length components within SL records. When processing crafted ISO filesystem images, an attacker can supply specially constructed Rock Ridge SL records where component length values exceed the actual record boundaries, causing reads beyond allocated memory. This affects any Linux system that mounts ISO 9660 filesystems with Rock Ridge extensions—commonly used for CD/DVD media and disk images—and could be exploited locally by mounting a malicious ISO image or remotely if the system auto-mounts untrusted media.
While CVE-2026-64317 itself lacks specific MITRE ATT&CK mapping, Casky's AI-driven analysis would identify this as part of privilege escalation and code execution attack chains. Practitioners using Casky would detect related techniques including T1203 (Exploitation for Privilege Escalation) through kernel memory corruption, T1068 (Exploitation for Privilege Escalation) patterns in filesystem handling logic, and T1566 (Phishing - Attachment) if delivery involves malicious ISO files. Casky's extended reasoning would flag anomalous filesystem parsing behaviors, memory boundary violations in kernel subsystems, and potential denial-of-service patterns from out-of-bounds reads. Security teams would see findings highlighting the need to validate all Rock Ridge record components against their claimed boundaries and implement strict bounds checking before reading component data, particularly when processing untrusted filesystem images.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64317. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation