CVE-2026-89778

Status: UPDATED  |  Advisory ID: CVE-2026-89778

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

isofs: fix out-of-bounds page array access on empty zisofs block

zisofs_uncompress_block()'s empty-block fast path returns

pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the

decompression path which returns bytes produced relative to poffset.

zisofs_fill_pages() uses that return to advance its page cursor, so when

the zisofs block size is below PAGE_SIZE and a sub-page block leaves

poffset partway into a page, a following empty block over-counts and

advances pages[] one element past its end, after which

"if (poffset && *pages)" reads pages[1] out of bounds. rock.c only

rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can

set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a

compressed file on such a mounted ISO9660 image.

Return the byte count relative to poffset and zero only

[poffset, PAGE_SIZE) of the first page, matching the decompression path.

The page-aligned case (poffset == 0) is unaffected.

BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)

Read of size 8 at addr ffff88800f5eac48 by task exploit/142

zisofs_read_folio (fs/isofs/compress.c:290)

read_pages (mm/readahead.c:184)

...

filemap_read (mm/filemap.c:2814)

vfs_read (fs/read_write.c:574)

__x64_sys_pread64 (fs/read_write.c:769)

do_syscall_64 (arch/x86/entry/syscall_64.c:94)

entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

The buggy address is located 0 bytes to the right of the

allocated 8-byte region in the kmalloc-8 cache (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References