CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not...

Security readout for executives and security teams

CVE-2014-9584 is a Linux kernel information-disclosure flaw in ISO9660 Rock Ridge handling. A local user with a crafted ISO image could make a vulnerable kernel expose sensitive kernel memory. The sources do not show active exploitation, and the provided CVSS and affected-product metadata are incomplete. Most relevant exposure is older Linux systems running kernels before 3.18.2 or vendor kernels covered by 2015 advisories. Risk depends on whether local users or services can cause the system to mount or parse untrusted ISO9660/Rock Ridge images. Treat this as a legacy-kernel exposure requiring cleanup, not an emergency internet-facing incident based on the supplied evidence. Prioritize systems that accept untrusted ISO images or allow many local users. Mitigation focus: Apply the relevant Linux kernel or distribution security update.; Confirm the kernel includes upstream commit 4e2024624e678f0ebb916e6192bd23c1f9fdf696.; Avoid mounting or processing untrusted ISO9660 images on vulnerable systems..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.