CVE-2026-89778 - Vulnerability Details

- isofs: fix out-of-bounds page array access on empty zisofs block

Description

In the Linux kernel, the following vulnerability has been resolved:

isofs: fix out-of-bounds page array access on empty zisofs block

zisofs_uncompress_block()'s empty-block fast path returns
pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the
decompression path which returns bytes produced relative to poffset.
zisofs_fill_pages() uses that return to advance its page cursor, so when
the zisofs block size is below PAGE_SIZE and a sub-page block leaves
poffset partway into a page, a following empty block over-counts and
advances pages[] one element past its end, after which
"if (poffset && *pages)" reads pages[1] out of bounds. rock.c only
rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can
set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a
compressed file on such a mounted ISO9660 image.

Return the byte count relative to poffset and zero only
[poffset, PAGE_SIZE) of the first page, matching the decompression path.
The page-aligned case (poffset == 0) is unaffected.

BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)
Read of size 8 at addr ffff88800f5eac48 by task exploit/142
zisofs_read_folio (fs/isofs/compress.c:290)
read_pages (mm/readahead.c:184)
...
filemap_read (mm/filemap.c:2814)
vfs_read (fs/read_write.c:574)
__x64_sys_pread64 (fs/read_write.c:769)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address is located 0 bytes to the right of the
allocated 8-byte region in the kmalloc-8 cache

Published: 2026-09-16

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the isofs subsystem of the Linux kernel. The fast path for handling an empty Zisofs block incorrectly calculates the byte count relative to the page offset, causing an out-of-bounds array access in zisofs_read_folio when a compressed ISO9660 image is read. An attacker could exploit the bug to read memory beyond the intended buffer, potentially leaking sensitive kernel data or executing arbitrary code with kernel privileges.

Affected Systems

The flaw affects any system running the Linux kernel that includes the isofs filesystem support before the patch that corrects the page array handling. Versions of the kernel that use the zisofs transparent decompression path prior to the repository commit that removes the bug are susceptible. The lack of specific version numbers means the vulnerability applies to all affected releases until the patch is applied.

Risk and Exploitability

The issue is triggered by a normal file read of a Zisofs-compressed ISO9660 image, which can be executed locally by any user with access to such a file. The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV. The CVSS score of 9.8 indicates a high impact. This out‑of‑bounds memory corruption could lead to privilege escalation or denial of service on the affected system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< 8b994ac5778a725982fd6a8a3afcaa068d4a93e3
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< 85904076cece72ee3194646ad7ac8e6659d999aa
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< f03425dcbe04aec3c27b9917e97d7d23a2908dda
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< cd616aa0449a772a6956abf03358f0ff31720580
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< 9c6eace8d07e90f038c89eb3b756d65a7e259d48
`59bc055211b8d266ab6089158058bf8268e02006`	affected	< 68d4d3e78150c7ed7d1195af63ad1e6ace30c661

Linux

affected

Version	Status	Constraints
`2.6.33`	affected	—
`0`	unaffected	< 2.6.33
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[59bc055211b8d266ab6089158058bf8268e02006,8b994ac5778a725982fd6a8a3afcaa068d4a93e3)`	affected	code_commit	—
`[59bc055211b8d266ab6089158058bf8268e02006,ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a)`	affected	code_commit	—
`[59bc055211b8d266ab6089158058bf8268e02006,85904076cece72ee3194646ad7ac8e6659d999aa)`	affected	code_commit	—
`[59bc055211b8d266ab6089158058bf8268e02006,f03425dcbe04aec3c27b9917e97d7d23a2908dda)`	affected	code_commit	—
`[59bc055211b8d266ab6089158058bf8268e02006,cd616aa0449a772a6956abf03358f0ff31720580)`	affected	code_commit	—
`[59bc055211b8d266ab6089158058bf8268e02006,9c6eace8d07e90f038c89eb3b756d65a7e259d48)`	affected	code_commit	—
`[59bc055211b8d266ab6089158058bf8268e02006,68d4d3e78150c7ed7d1195af63ad1e6ace30c661)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.33`	affected	semver	—
`[0,2.6.33)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the isofs patch
Disable Zisofs support if it is a loadable module
Remove or quarantine untrusted ISO9660 images containing Zisofs compression from privileged paths

Generated by OpenCVE AI on September 20, 2026 at 04:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00697.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661
https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa
https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3
https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48
https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a
https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580
https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda

History

Sun, 20 Sep 2026 05:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 18 Sep 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-787

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which "if (poffset && *pages)" reads pages[1] out of bounds. rock.c only rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image. Return the byte count relative to poffset and zero only [poffset, PAGE_SIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected. BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofs_read_folio (fs/isofs/compress.c:290) read_pages (mm/readahead.c:184) ... filemap_read (mm/filemap.c:2814) vfs_read (fs/read_write.c:574) __x64_sys_pread64 (fs/read_write.c:769) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
Title		isofs: fix out-of-bounds page array access on empty zisofs block
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661 https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3 https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48 https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580 https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:18.407Z

Updated: 2026-09-16T14:38:29.867Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89778

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.253

Modified: 2026-09-16T15:18:07.167

Link: CVE-2026-89778

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T04:45:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object