Live › vulnerability › CVE-2026-98636
Go to dashboardA crafted SquashFS image with the compression options flag set but a dictionary size of zero makes the kernel compute a negative shift exponent when it is mounted. The result is an undefined-behavior shift-out-of-bounds in the kernel's squashfs XZ option parsing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel without the upstream fix that mount SquashFS images, most often when a user or service mounts images from an untrusted source. Systems that never mount SquashFS images, or that only mount trusted images built in-house, have little exposure. The sources do not give a kernel version range.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds in the upstream stable advisory linked from NVD.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds.
Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds
Fix it by adding a dictionary size range check before the shift operation.
This page as .md · .json · in your agent: get_signal("CVE-2026-98636")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.