Squashfs: check block offset is not negative

Summary

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access. Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied. To trigger this out of bounds access requires a crafted Squashfs filesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be able to mount such a filesystem, but once mounted, an unprivileged user can trigger the out of bounds access by reading the crafted file with the negative offset.

Timeline

1. Sep 17, 2026, 4:07 PM UTCCVE published
2. Oct 19, 2026, 8:59 AM UTCRecord last updated

Affected versions

• Linux Linux

  From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in b169185d5c672b989985c6c2e38cafab2548ba88; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in c2a126fca820ae74872da28de68dc74d4595dc4b; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in 95dadf366c117dcdca78a570e6832071deab1ecd; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in 3d2f0cb66c909ea2312cdef465165bb9a3ba2d84; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in bbb2218eb072b0a15dc063929200183bd23c2344; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in d0a3729d464fcf516416a41cf304c0c92126ee03; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe; From f400e12656ab518be107febfe2315fb1eab5a342 · fixed in e300eb5002925b29be803d2661af07266cfa267e

• Linux Linux

  2.6.29

• KernelLinux

  From 2.6.29 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8