CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block
In the Linux kernel, the following vulnerability has been resolved:
isofs: fix out-of-bounds page array access on empty zisofs block
zisofsuncompressblock()'s empty-block fast path returns pcount << PAGESHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofsfillpages() uses that return to advance its page cursor, so when the zisofs block size is below PAGESIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which "if (poffset && pages)" reads pages[1] out of bounds. rock.c only rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image.
Return the byte count relative to poffset and zero only [poffset, PAGESIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected.
BUG: KASAN: slab-out-of-bounds in zisofsreadfolio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofsreadfolio (fs/isofs/compress.c:290) readpages (mm/readahead.c:184) ... filemapread (mm/filemap.c:2814) vfsread (fs/readwrite.c:574) x64syspread64 (fs/readwrite.c:769) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed in practice?
Systems are exposed when they mount an ISO9660 image containing a crafted Rock Ridge "ZF" record and read a compressed zisofs file from that image. The issue is triggered by an ordinary read() operation.
What must an attacker control to trigger the issue?
An attacker needs to provide a crafted ISO9660 image whose "ZF" Rock Ridge record specifies a zisofs block-size shift below PAGE_SHIFT. The crafted image must contain a compressed file that is subsequently read.
Are all malformed block-size settings affected?
The problematic condition is a sub-page zisofs block size, where the block-size shift is below PAGE_SHIFT. Page-aligned processing, where poffset is zero, is unaffected.
What can be done before an update is available?
Avoid mounting untrusted ISO9660 images and avoid reading compressed zisofs files from images that may contain attacker-controlled Rock Ridge metadata.
What evidence may indicate the issue has been triggered?
The reported failure is a KASAN slab-out-of-bounds read in zisofs_read_folio in fs/isofs/compress.c. The out-of-bounds access occurs after page cursor advancement causes pages[1] to be read past the page array.