GHSA-WGFG-84P9-XMPV
Vulnerability from github – Published: 2026-10-18 18:31 – Updated: 2026-10-18 18:31In the Linux kernel, the following vulnerability has been resolved:
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds.
Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds
Fix it by adding a dictionary size range check before the shift operation.
{
"affected": [],
"aliases": [
"CVE-2026-98636"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:16Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsquashfs: Add dictionary size range check to prevent shift-out-of-bounds\n\nWhen an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size\nis 0) is mounted, and performs shift operations using dictionarysize, the\nshift exponent is -1, causing a shift-out-of-bounds.\n\nDetail as below:\nsquashfs_comp_opts(msblk, buffer, length)\n squashfs_xz_comp_opts()\n if (comp_opts)\n n = ffs(opts-\u003edict_size) - 1;\u003c----opts-\u003edict_size=0, n=-1\n if (opts-\u003edict_size != (1 \u003c\u003c n) \u0026\u0026 opts-\u003edict_size !=\n\t \t(1 \u003c\u003c n) + (1 \u003c\u003c (n + 1))) \u003c----shift-out-of-bounds\n\nFix it by adding a dictionary size range check before the shift operation.",
"id": "GHSA-wgfg-84p9-xmpv",
"modified": "2026-10-18T18:31:57Z",
"published": "2026-10-18T18:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98636"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0cb85377daaefb4ce5ce72975f2deb27ee0e0cad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1f7745fb3580152ca902ef181b605f33cabfb1d0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88c673a0bd233df44ca0020da82f4fd3876de27a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d9c5c218ea356a1d88765214ad2919605280ab1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b02948a23455f8190a53887b2d2c13ae1d360cea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c68e0068a236f9a7dfc19720bdf11e5d80a85089"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e1ca4e3a380ef3e8f46ce006f1146392e3f32c98"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.