Executive brief
The Linux kernel's ISO9660 filesystem driver (isofs) contains a memory access vulnerability in its zisofs compression handler. A crafted ISO9660 image with maliciously configured compression settings can trigger an out-of-bounds memory read when a user attempts to read a compressed file. An attacker can exploit this to crash the system or potentially extract sensitive kernel data.
Technical details
The vulnerability exists in zisofs_uncompress_block() in fs/isofs/compress.c, where the fast-path for empty compressed blocks incorrectly calculates the byte count returned to the caller. When zisofs block size is below PAGE_SIZE and poffset is non-zero, empty blocks return a value that doesn't account for poffset, causing zisofs_fill_pages() to advance its page array cursor past the allocated boundary. The Rock Ridge extension validation only rejects block-size shifts greater than 17 (vs PAGE_SHIFT of 12), allowing a crafted ZF record to trigger the bug. The out-of-bounds read occurs when checking "if (poffset && *pages)" at pages[1]. The fix adjusts the return value to be relative to poffset and properly zeroes only the required portion of the first page, matching the decompression path behavior.
Affected products
- Linux Linux Kernel multiple versions
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: CVE-2026-89778 published