Description
In the Linux kernel, the following vulnerability has been resolved:

squashfs: Add dictionary size range check to prevent shift-out-of-bounds

When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size
is 0) is mounted, and performs shift operations using dictionarysize, the
shift exponent is -1, causing a shift-out-of-bounds.

Detail as below:
squashfs_comp_opts(msblk, buffer, length)
squashfs_xz_comp_opts()
if (comp_opts)
n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1
if (opts->dict_size != (1 << n) && opts->dict_size !=
(1 << n) + (1 << (n + 1))) <----shift-out-of-bounds

Fix it by adding a dictionary size range check before the shift operation.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel buffer overflow enabling arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

The Linux kernel squashfs module contains a bug where a specially crafted SquashFS image that sets the COMP_OPTS flag to 1 but specifies a dictionary size of 0 causes the code to perform a left shift using a negative exponent. This leads to a shift‑out‑of‑bounds condition that corrupts kernel memory and can be exploited by an attacker who can mount the image, potentially allowing arbitrary code execution with kernel privileges or causing a system crash.

Affected Systems

All Linux kernel versions that include the squashfs filesystem compiled with COMP_OPTS enabled and accept images with a dictionary size of zero are affected. Versions prior to the inclusion of the patch are vulnerable. The fix was applied in a later kernel release, so any kernel before that point remains at risk.

Risk and Exploitability

The flaw can lead to kernel memory corruption, a high‑severity vulnerability. Because exploiting it requires mounting a malformed SquashFS image, it is mainly exploitable by users with local mount or filesystem privileges. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 18, 2026 at 18:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that contains the squashfs dictionary size range check fix.
  • If an update is unavailable, restrict the use of SquashFS filesystems with COMP_OPTS enabled and ensure dictionary size is greater than zero; otherwise avoid mounting such images.
  • Validate any SquashFS images before mounting to detect a dictionary size of zero, and reject or repair them.

Generated by OpenCVE AI on October 18, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-788

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds. Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds Fix it by adding a dictionary size range check before the shift operation.
Title squashfs: Add dictionary size range check to prevent shift-out-of-bounds
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:20:07.184Z

Reserved: 2026-09-25T10:25:14.361Z

Link: CVE-2026-98636

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:16.700

Modified: 2026-10-18T16:17:16.700

Link: CVE-2026-98636

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T18:15:15Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

  • CWE-788

    Access of Memory Location After End of Buffer