CVE-2026-89778isofs: fix out-of-bounds page array access on empty zisofs block
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which "if (poffset && *pages)" reads pages[1] out of bounds. rock.c only rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image. Return the byte count relative to poffset and zero only [poffset, PAGE_SIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected. BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofs_read_folio (fs/isofs/compress.c:290) read_pages (mm/readahead.c:184) ... filemap_read (mm/filemap.c:2814) vfs_read (fs/read_write.c:574) __x64_sys_pread64 (fs/read_write.c:769) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 59bc055211b8d266ab6089158058bf8268e02006 builds before 8b994ac5778a725982fd6a8a3afcaa068d4a93e3; from 59bc055211b8d266ab6089158058bf8268e02006 before ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a; from 59bc055211b8d266ab6089158058bf8268e02006 before 85904076cece72ee3194646ad7ac8e6659d999aa; from 59bc055211b8d266ab6089158058bf8268e02006 before f03425dcbe04aec3c27b9917e97d7d23a2908dda; from 59bc055211b8d266ab6089158058bf8268e02006 before cd616aa0449a772a6956abf03358f0ff31720580; 59bc055211b8d266ab6089158058bf8268e02006 builds before 9c6eace8d07e90f038c89eb3b756d65a7e259d48; from 59bc055211b8d266ab6089158058bf8268e02006 before 68d4d3e78150c7ed7d1195af63ad1e6ace30c661 | CNA record |
References
- https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3
- https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a
- https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa
- https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda
- https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580
- https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48
- https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.