CVE-2026-98879 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

isofs: handle set_blocksize failures

isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the

BUG_ON(offset >= folio_size(folio));

in folio_set_bh on the first __bread_gfp call.

Published: 2026-10-23

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s isofs module mishandles block sizes larger than the system page size. When an ISO image specifies an unsupported block size, the module invokes a kernel assertion, resulting in a BUG_ON fault in the folio_set_bh routine. This causes the kernel to panic, a local denial‑of‑service vector that takes the machine offline until reboot.

Affected Systems

All Linux kernels that include the unpatched isofs code are affected. The upstream repository shows the remediation was added after commit 25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32, so any distribution shipping a kernel older than that introduces this vulnerability regardless of the distro name.

Risk and Exploitability

The EPSS score is < 1% and the CVSS score is 4.4, and the vulnerability is absent from CISA's KEV catalog, indicating it is not currently a known actively exploited target. Exploitation requires the ability to mount a crafted ISO image, a privilege that typically requires local mount rights or control over the filesystem used for mounting. The attack thus presents a local denial‑of‑service risk rather than a remote code execution surface, and it is limited to machines where the faulty isofs code path can be triggered.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6db7f0ba365786304558db6a3d52013ae176e03e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 61f277bf35f533b602984f0e55900111fe52f31a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cebde6d88e34396c29f2f001d90e921677cc17d6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 28d1f6aa14f5924e36602b7a31c9141d34de0b9c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9c97e3b1152d3092581745189f5d2f04c6404ef9
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9584ab6283721e5aab485c79bd06c2f78d89e55c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6db7f0ba365786304558db6a3d52013ae176e03e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,61f277bf35f533b602984f0e55900111fe52f31a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cebde6d88e34396c29f2f001d90e921677cc17d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d1f6aa14f5924e36602b7a31c9141d34de0b9c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9c97e3b1152d3092581745189f5d2f04c6404ef9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9584ab6283721e5aab485c79bd06c2f78d89e55c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6db7f0ba365786304558db6a3d52013ae176e03e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,61f277bf35f533b602984f0e55900111fe52f31a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cebde6d88e34396c29f2f001d90e921677cc17d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d1f6aa14f5924e36602b7a31c9141d34de0b9c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9c97e3b1152d3092581745189f5d2f04c6404ef9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9584ab6283721e5aab485c79bd06c2f78d89e55c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest kernel release that contains the commit 25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32, guaranteeing that isofs correctly enforces block‑size limits.
If a kernel upgrade cannot be performed immediately, restrict ISO mounts to images that use standard block sizes (e.g., 4096 bytes) and employ mount options or device restrictions to prevent the faulty code path from executing.
Set up continuous monitoring of dmesg and system logs for BUG_ON or kernel panic messages related to isofs mounts; configure alerts to trigger rapid response and, if needed, a automatic reboot to restore service.

Generated by OpenCVE AI on October 27, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00179.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98879.mbox
https://git.kernel.org/stable/c/25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32
https://git.kernel.org/stable/c/28d1f6aa14f5924e36602b7a31c9141d34de0b9c
https://git.kernel.org/stable/c/61f277bf35f533b602984f0e55900111fe52f31a
https://git.kernel.org/stable/c/6db7f0ba365786304558db6a3d52013ae176e03e
https://git.kernel.org/stable/c/9584ab6283721e5aab485c79bd06c2f78d89e55c
https://git.kernel.org/stable/c/9c97e3b1152d3092581745189f5d2f04c6404ef9
https://git.kernel.org/stable/c/cebde6d88e34396c29f2f001d90e921677cc17d6
https://nvd.nist.gov/vuln/detail/CVE-2026-98879
https://www.cve.org/CVERecord?id=CVE-2026-98879

History

Tue, 27 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-398

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98879.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98879 https://www.cve.org/CVERecord?id=CVE-2026-98879
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-398

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: isofs: handle set_blocksize failures isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bread_gfp call.
Title		isofs: handle set_blocksize failures
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32 https://git.kernel.org/stable/c/28d1f6aa14f5924e36602b7a31c9141d34de0b9c https://git.kernel.org/stable/c/61f277bf35f533b602984f0e55900111fe52f31a https://git.kernel.org/stable/c/6db7f0ba365786304558db6a3d52013ae176e03e https://git.kernel.org/stable/c/9584ab6283721e5aab485c79bd06c2f78d89e55c https://git.kernel.org/stable/c/9c97e3b1152d3092581745189f5d2f04c6404ef9 https://git.kernel.org/stable/c/cebde6d88e34396c29f2f001d90e921677cc17d6

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:28.048Z

Updated: 2026-10-26T06:56:02.033Z

Reserved: 2026-09-25T10:25:14.377Z

Link: CVE-2026-98879

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:21.440

Modified: 2026-10-26T07:17:12.420

Link: CVE-2026-98879

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98879 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object