CVE-2026-90203 (GCVE-0-2026-90203)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
Squashfs: check block offset is not negative
Summary
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access. Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied. To trigger this out of bounds access requires a crafted Squashfs filesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be able to mount such a filesystem, but once mounted, an unprivileged user can trigger the out of bounds access by reading the crafted file with the negative offset.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < b169185d5c672b989985c6c2e38cafab2548ba88 (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < c2a126fca820ae74872da28de68dc74d4595dc4b (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < 95dadf366c117dcdca78a570e6832071deab1ecd (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < 3d2f0cb66c909ea2312cdef465165bb9a3ba2d84 (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < bbb2218eb072b0a15dc063929200183bd23c2344 (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < d0a3729d464fcf516416a41cf304c0c92126ee03 (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe (git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < e300eb5002925b29be803d2661af07266cfa267e (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/squashfs/cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b169185d5c672b989985c6c2e38cafab2548ba88",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "c2a126fca820ae74872da28de68dc74d4595dc4b",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "95dadf366c117dcdca78a570e6832071deab1ecd",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "3d2f0cb66c909ea2312cdef465165bb9a3ba2d84",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "bbb2218eb072b0a15dc063929200183bd23c2344",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "d0a3729d464fcf516416a41cf304c0c92126ee03",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            },
            {
              "lessThan": "e300eb5002925b29be803d2661af07266cfa267e",
              "status": "affected",
              "version": "f400e12656ab518be107febfe2315fb1eab5a342",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/squashfs/cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check block offset is not negative\n\nIf a negative offset is read off disk (for example the offset into the\ndecompressed fragment block), this will cause squashfs_copy_data() to\nperform an out of bounds access.\n\nFix by checking if offset is negative, and returning 0.  This matches\nexisting behaviour where an offset beyond the block returns 0 bytes\ncopied.\n\nTo trigger this out of bounds access requires a crafted Squashfs\nfilesystem and CAP_SYS_ADMIN to mount it.  Unprivileged users will not be\nable to mount such a filesystem, but once mounted, an unprivileged user\ncan trigger the out of bounds access by reading the crafted file with the\nnegative offset."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bad bytes are squashfs_reg_inode.offset/squashfs_lreg_inode.offset, stored by squashfs_read_inode() as fragment_offset and used by squashfs_read_folio()/squashfs_readahead_fragment() \u2192 squashfs_copy_data() on a loop/block-backed image. That field is on-disk fragment metadata, not a network protocol message; squashfs_fs_type is FS_REQUIRES_DEV.\nAC:L - squashfs_read_inode() assigns le32_to_cpu(sqsh_ino-\u003eoffset) to signed int fragment_offset with no range check, so a high-bit-set on-disk value is negative. read() of that file\u0027s tail (generic_file_read_iter \u2192 squashfs_read_folio) then calls squashfs_copy_data() with that offset; there is no race.\nPR:N - squashfs_fs_type has no FS_USERNS_MOUNT, so mount_capable() needs init-namespace CAP_SYS_ADMIN, but the attacker who crafts the image needs no account. After that privileged mount, an unprivileged read of the crafted file is enough; the mount is scored as User Interaction, not Privileges Required.\nUI:R - The negative fragment_offset exists only in an attacker-supplied Squashfs image, and squashfs_copy_data() runs only after that image is mounted and the crafted file is read. The mount is the required victim action; a standing snapd or live-image setup does not remove it.\nS:U - squashfs_copy_data() indexes the fragment cache\u0027s kmalloc\u0027d data[] array and memcpy\u0027s into the file\u0027s own page-cache folio in the same kernel. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.\nC:H - A negative offset makes squashfs_copy_data() evaluate entry-\u003edata[offset/PAGE_SIZE] before the kcalloc\u0027d pointer array, then memcpy up to PAGE_SIZE bytes from that address into the folio returned by read(). That is an unbounded OOB kernel read into userspace, not a few-byte leak.\nI:N - The memcpy destination is the kmap of the crafted file\u0027s own folio in squashfs_fill_page()/squashfs_readahead_fragment(); the source is the OOB pointer. Length is capped by avail (\u2264PAGE_SIZE), so this path does not write kernel objects out of bounds.\nA:H - Indexing entry-\u003edata[] with a negative offset/PAGE_SIZE and memcpy from the resulting pointer is the same squashfs_copy_data() out-of-bounds access that produced a general protection fault in CVE-2026-23388; an unmapped address oopses the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:41.435Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b169185d5c672b989985c6c2e38cafab2548ba88"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2a126fca820ae74872da28de68dc74d4595dc4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/95dadf366c117dcdca78a570e6832071deab1ecd"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2f0cb66c909ea2312cdef465165bb9a3ba2d84"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbb2218eb072b0a15dc063929200183bd23c2344"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0a3729d464fcf516416a41cf304c0c92126ee03"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e300eb5002925b29be803d2661af07266cfa267e"
        }
      ],
      "title": "Squashfs: check block offset is not negative",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90203",
    "datePublished": "2026-09-17T16:07:20.180Z",
    "dateReserved": "2026-09-11T19:38:34.792Z",
    "dateUpdated": "2026-09-18T17:53:41.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90203",
      "date": "2026-09-25",
      "epss": "0.00176",
      "percentile": "0.06426"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/squashfs/cache.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b169185d5c672b989985c6c2e38cafab2548ba88",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c2a126fca820ae74872da28de68dc74d4595dc4b",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95dadf366c117dcdca78a570e6832071deab1ecd",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d2f0cb66c909ea2312cdef465165bb9a3ba2d84",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bbb2218eb072b0a15dc063929200183bd23c2344",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0a3729d464fcf516416a41cf304c0c92126ee03",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e300eb5002925b29be803d2661af07266cfa267e",
                    "status": "affected",
                    "version": "f400e12656ab518be107febfe2315fb1eab5a342",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/squashfs/cache.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.29"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check block offset is not negative\n\nIf a negative offset is read off disk (for example the offset into the\ndecompressed fragment block), this will cause squashfs_copy_data() to\nperform an out of bounds access.\n\nFix by checking if offset is negative, and returning 0.  This matches\nexisting behaviour where an offset beyond the block returns 0 bytes\ncopied.\n\nTo trigger this out of bounds access requires a crafted Squashfs\nfilesystem and CAP_SYS_ADMIN to mount it.  Unprivileged users will not be\nable to mount such a filesystem, but once mounted, an unprivileged user\ncan trigger the out of bounds access by reading the crafted file with the\nnegative offset."
          }
        ],
        "id": "CVE-2026-90203",
        "lastModified": "2026-09-18T18:17:46.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:15.320",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d2f0cb66c909ea2312cdef465165bb9a3ba2d84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95dadf366c117dcdca78a570e6832071deab1ecd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b169185d5c672b989985c6c2e38cafab2548ba88"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bbb2218eb072b0a15dc063929200183bd23c2344"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c2a126fca820ae74872da28de68dc74d4595dc4b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0a3729d464fcf516416a41cf304c0c92126ee03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e300eb5002925b29be803d2661af07266cfa267e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.