CVE-2026-90203

Squashfs: check block offset is not negative

State: Published
Severity: 7.1 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check block offset is not negative

If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access.

Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied.

To trigger this out of bounds access requires a crafted Squashfs filesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be able to mount such a filesystem, but once mounted, an unprivileged user can trigger the out of bounds access by reading the crafted file with the negative offset.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f400e12656ab518be107febfe2315fb1eab5a342 to before b169185d5c672b989985c6c2e38cafab2548ba88Affected f400e12656ab518be107febfe2315fb1eab5a342 to before c2a126fca820ae74872da28de68dc74d4595dc4bAffected f400e12656ab518be107febfe2315fb1eab5a342 to before 95dadf366c117dcdca78a570e6832071deab1ecdAffected f400e12656ab518be107febfe2315fb1eab5a342 to before 3d2f0cb66c909ea2312cdef465165bb9a3ba2d84Affected f400e12656ab518be107febfe2315fb1eab5a342 to before bbb2218eb072b0a15dc063929200183bd23c2344Affected f400e12656ab518be107febfe2315fb1eab5a342 to before d0a3729d464fcf516416a41cf304c0c92126ee03Affected f400e12656ab518be107febfe2315fb1eab5a342 to before e4afd90bc7bf3dd477970c6c42bdd29ad3fda7feAffected f400e12656ab518be107febfe2315fb1eab5a342 to before e300eb5002925b29be803d2661af07266cfa267eAffected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f400e12656ab518be107febfe2315fb1eab5a342 to before b169185d5c672b989985c6c2e38cafab2548ba88Affected
f400e12656ab518be107febfe2315fb1eab5a342 to before c2a126fca820ae74872da28de68dc74d4595dc4bAffected
f400e12656ab518be107febfe2315fb1eab5a342 to before 95dadf366c117dcdca78a570e6832071deab1ecdAffected
f400e12656ab518be107febfe2315fb1eab5a342 to before 3d2f0cb66c909ea2312cdef465165bb9a3ba2d84Affected
f400e12656ab518be107febfe2315fb1eab5a342 to before bbb2218eb072b0a15dc063929200183bd23c2344Affected
f400e12656ab518be107febfe2315fb1eab5a342 to before d0a3729d464fcf516416a41cf304c0c92126ee03Affected
f400e12656ab518be107febfe2315fb1eab5a342 to before e4afd90bc7bf3dd477970c6c42bdd29ad3fda7feAffected
f400e12656ab518be107febfe2315fb1eab5a342 to before e300eb5002925b29be803d2661af07266cfa267eAffected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.