{"id":"CVE-2026-98879","kind":"vulnerability","aliases":["CVE-2026-98879"],"related":[],"title":"Linux kernel isofs: mounting oversized block sizes crashes the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: handle set_blocksize failures\n\nisofs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call.","summary":"In the Linux kernel's isofs driver, a block size larger than the page size is not rejected cleanly when mounting, so the kernel hits a BUG_ON during the first buffer read. The sources describe a kernel crash at mount time, and do not say that an attacker can gain code execution or read data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","isofs","linux-kernel","self-hosted"],"not_affected_if":["no-isofs-mounts"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether isofs is loaded or available with `lsmod | grep isofs` or `modinfo isofs`\n- unknown whether the sources list affected kernel version ranges","fix":"- Update to a kernel release that includes the upstream isofs set_blocksize fix (version unknown from sources)\n- unknown whether the sources name a specific fixed kernel version","status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:13+00:00","updated_at":"2026-10-25T05:00:13+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:00:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes the upstream isofs set_blocksize fix (version unknown from sources)\n- unknown whether the sources name a specific fixed kernel version","reach":"local","title":"Linux kernel isofs: mounting oversized block sizes crashes the kernel","impact":"low","summary":"In the Linux kernel's isofs driver, a block size larger than the page size is not rejected cleanly when mounting, so the kernel hits a BUG_ON during the first buffer read. The sources describe a kernel crash at mount time, and do not say that an attacker can gain code execution or read data.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","isofs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel BUG_ON crash during mount, possibly denial of service","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, the fixed stable versions, and whether a crafted image can be triggered remotely or only by a local mount.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether isofs is loaded or available with `lsmod | grep isofs` or `modinfo isofs`\n- unknown whether the sources list affected kernel version ranges","needs_analyst":true,"not_affected_if":["no-isofs-mounts"],"who_is_affected":"Systems that mount ISO 9660 filesystems with the isofs driver are the ones the fix matters for, mainly hosts that handle CD or DVD images or untrusted disk images. The sources do not say which kernel versions are affected, so systems that never mount isofs media are likely able to skip it, but this is not confirmed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00065,"input_tokens":3338,"output_tokens":633,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98879':13A,16A 'attack':73B 'bh':125C 'block':6A,33B,104C 'blocksiz':94C 'bread':129C 'buffer':56B,98C 'bug':51B,116C 'call':131C 'clean':43B 'code':76B 'crash':8A,63B 'cve':11A,14A 'data':80B 'describ':60B 'driver':31B 'execut':77B 'failur':95C 'first':55B,128C 'folio':119C,121C,123C 'follow':86C 'gain':75B 'gfp':130C 'handl':92C,103C 'head':99C 'hit':49B,114C 'host':24B 'infrastructur':17B 'isof':3A,18B,30B,91C,96C 'kernel':2A,10A,21B,28B,48B,62B,84C 'larger':35B 'linux':1A,20B,27B,83C 'linux-kernel':19B 'mount':4A,45B,65B,111C 'offset':118C 'overs':5A 'page':38B,106C 'read':57B,79B 'reject':42B 'resolv':90C 'say':70B 'self':23B 'self-host':22B 'set':93C,124C 'size':7A,34B,39B,105C,107C,120C 'sourc':59B 'time':66B 'use':97C 'vulner':87C 'well':108C 'without':109C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount ISO 9660 filesystems with the isofs driver are the ones the fix matters for, mainly hosts that handle CD or DVD images or untrusted disk images. The sources do not say which kernel versions are affected, so systems that never mount isofs media are likely able to skip it, but this is not confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98879","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}