CVE-2026-98636

squashfs: Add dictionary size range check to prevent shift-out-of-bounds

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

squashfs: Add dictionary size range check to prevent shift-out-of-bounds

When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds.

Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds

Fix it by adding a dictionary size range check before the shift operation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ff750311d30acc9564ef577050794953eee59f01 to before b02948a23455f8190a53887b2d2c13ae1d360ceaAffected ff750311d30acc9564ef577050794953eee59f01 to before 9d9c5c218ea356a1d88765214ad2919605280ab1Affected ff750311d30acc9564ef577050794953eee59f01 to before 7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1Affected ff750311d30acc9564ef577050794953eee59f01 to before c68e0068a236f9a7dfc19720bdf11e5d80a85089Affected ff750311d30acc9564ef577050794953eee59f01 to before 88c673a0bd233df44ca0020da82f4fd3876de27aAffected ff750311d30acc9564ef577050794953eee59f01 to before 0cb85377daaefb4ce5ce72975f2deb27ee0e0cadAffected ff750311d30acc9564ef577050794953eee59f01 to before e1ca4e3a380ef3e8f46ce006f1146392e3f32c98Affected ff750311d30acc9564ef577050794953eee59f01 to before 1f7745fb3580152ca902ef181b605f33cabfb1d0Affected
LinuxLinux	2.6.39Affected before 2.6.39Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ff750311d30acc9564ef577050794953eee59f01 to before b02948a23455f8190a53887b2d2c13ae1d360ceaAffected
ff750311d30acc9564ef577050794953eee59f01 to before 9d9c5c218ea356a1d88765214ad2919605280ab1Affected
ff750311d30acc9564ef577050794953eee59f01 to before 7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1Affected
ff750311d30acc9564ef577050794953eee59f01 to before c68e0068a236f9a7dfc19720bdf11e5d80a85089Affected
ff750311d30acc9564ef577050794953eee59f01 to before 88c673a0bd233df44ca0020da82f4fd3876de27aAffected
ff750311d30acc9564ef577050794953eee59f01 to before 0cb85377daaefb4ce5ce72975f2deb27ee0e0cadAffected
ff750311d30acc9564ef577050794953eee59f01 to before e1ca4e3a380ef3e8f46ce006f1146392e3f32c98Affected
ff750311d30acc9564ef577050794953eee59f01 to before 1f7745fb3580152ca902ef181b605f33cabfb1d0Affected

LinuxLinux

2.6.39Affected
before 2.6.39Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.