CVE-2026-98636: squashfs: Add dictionary size range check to prevent shift-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved:
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
When an abnormal SquashFS image (COMPOPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds.
Detail as below: squashfscompopts(msblk, buffer, length) squashfsxzcompopts() if (compopts) n = ffs(opts->dictsize) - 1;<----opts->dictsize=0, n=-1 if (opts->dictsize != (1 << n) && opts->dictsize != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds
Fix it by adding a dictionary size range check before the shift operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a dictionary size range check before shift operations in SquashFS compression option handling (squashfs_comp_opts/squashfs_xz_comp_opts), preventing an abnormal image with opts->dict_size=0 from producing n=-1 and a shift-out-of-bounds.
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
The system must mount an abnormal SquashFS image with the COMP_OPTS flag set to 1 and an XZ dictionary size of 0. Processing that image causes the kernel to calculate a shift exponent of -1 and perform an out-of-bounds shift.
Which systems are realistically exposed?
Systems that mount SquashFS images are exposed to malformed images meeting the specified compression-options condition. The provided information does not identify whether any particular distribution, kernel configuration, or default mounting behavior is affected.
What is the immediate mitigation if a fixed kernel cannot be deployed?
Avoid mounting untrusted or malformed SquashFS images, particularly images that use compression options with an XZ dictionary size of 0. The provided information does not specify an alternative configuration-based mitigation.