Executive brief
The Linux kernel's Squashfs filesystem handler contains a flaw where negative offset values read from a crafted filesystem image can trigger out-of-bounds memory access. While mounting a malicious Squashfs image requires administrator privileges, any unprivileged user can then trigger the vulnerability by reading files, potentially causing a kernel crash or information disclosure.
Technical details
The vulnerability is an out-of-bounds access in the squashfs_copy_data() function (fs/squashfs/cache.c) caused by insufficient validation of the offset parameter. If a negative offset value is read from the decompressed fragment block on disk, the function performs an out-of-bounds memory access. The attack requires a crafted Squashfs filesystem mounted by a privileged user (CAP_SYS_ADMIN), but exploitation can be triggered by an unprivileged user reading a specially crafted file. The fix adds a check to return 0 if offset is negative, matching the existing behavior for out-of-bounds offsets beyond the block. A patch is available in the kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions; fixes commit f400e12656ab onwards
Timeline
- 2026-09-17: disclosed: CVE-2026-90203 published
- 2026-09-14: patched: Upstream commit e300eb5002925b29be803d2661af07266cfa267e