All vulnerabilities
CVE-2026-98636

Linux: squashfs: Add dictionary size range check to prevent shift-out-of-bounds

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9d9c5c218ea356a1d88765214ad2919605280ab1Also 7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1, 88c673a0bd233df44ca0020da82f4fd3876de27a and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 9d9c5c218ea356a1d88765214ad2919605280ab1LinuxCVE List
  • 7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1LinuxCVE List
  • 88c673a0bd233df44ca0020da82f4fd3876de27aLinuxCVE List
  • 0cb85377daaefb4ce5ce72975f2deb27ee0e0cadLinuxCVE List
  • 1f7745fb3580152ca902ef181b605f33cabfb1d0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

squashfs: Add dictionary size range check to prevent shift-out-of-bounds

When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds.

Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds

Fix it by adding a dictionary size range check before the shift operation.

Text from CVE List

Affected versions 18

  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before b02948a23455f8190a53887b2d2c13ae1d360ceaCVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before 9d9c5c218ea356a1d88765214ad2919605280ab1CVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before 7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1CVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before c68e0068a236f9a7dfc19720bdf11e5d80a85089CVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before 88c673a0bd233df44ca0020da82f4fd3876de27aCVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before 0cb85377daaefb4ce5ce72975f2deb27ee0e0cadCVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before e1ca4e3a380ef3e8f46ce006f1146392e3f32c98CVE List
  • Linuxaffected: ff750311d30acc9564ef577050794953eee59f01 before 1f7745fb3580152ca902ef181b605f33cabfb1d0CVE List
  • Linuxaffected: 2.6.39CVE List
  • Linuxunaffected: all versions before 2.6.39CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8