VYPR
← All advisories
High severity7.1NVD Advisory· Published May 1, 2024· Updated May 12, 2026

CVE-2024-26982

CVE-2024-26982

Description

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check the inode number is not the invalid value of zero

Syskiller has produced an out of bounds access in fill_meta_index().

That out of bounds access is ultimately caused because the inode has an inode number with the invalid value of zero, which was not checked.

The reason this causes the out of bounds access is due to following sequence of events:

1. Fill_meta_index() is called to allocate (via empty_meta_index()) and fill a metadata index. It however suffers a data read error and aborts, invalidating the newly returned empty metadata index. It does this by setting the inode number of the index to zero, which means unused (zero is not a valid inode number).

2. When fill_meta_index() is subsequently called again on another read operation, locate_meta_index() returns the previous index because it matches the inode number of 0. Because this index has been returned it is expected to have been filled, and because it hasn't been, an out of bounds access is performed.

This patch adds a sanity check which checks that the inode number is not zero when the inode is created and returns -EINVAL if it is.

[phillip@squashfs.org.uk: whitespace fix]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing sanity check in Linux kernel's Squashfs driver allows an out-of-bounds access when an inode number is zero.

Vulnerability

CVE-2024-26982 is a vulnerability in the Linux kernel's Squashfs filesystem driver. The root cause is a missing sanity check for the inode number being the invalid value of zero. During inode creation, the code did not verify that the inode number is non-zero, which is an invalid value in Squashfs. This oversight can lead to an out-of-bounds access in the fill_meta_index() function, as reported by the syzkaller fuzzer. [1]

Exploitation

An attacker can trigger this vulnerability by mounting a specially crafted Squashfs image that contains an inode with an inode number of zero. The exploit sequence involves: (1) fill_meta_index() allocates an empty metadata index but aborts due to a data read error, setting the index's inode number to zero to mark it unused; (2) on a subsequent read operation, locate_meta_index() returns this invalid index because it matches the inode number zero, expecting it to have been filled. Because the index was never filled, the subsequent access results in an out-of-bounds read or write. [1]

Impact

Successful exploitation can lead to an out-of-bounds memory access, potentially causing a denial of service (system crash) or information disclosure. The CVSS v3.1 base score is 7.1 (High), indicating significant impact on confidentiality, integrity, or availability. The vulnerability affects the Linux kernel's Squashfs driver, which is widely used in embedded systems, including Siemens SIMATIC S7-1500 TM MFP devices, as indicated in the Siemens advisory SSA-265688. [1][2]

Mitigation

The fix adds a sanity check during inode creation that returns -EINVAL if the inode number is zero, preventing the creation of such invalid inodes. The patch has been applied to the Linux kernel stable branches. Users should update their kernel to a version containing the fix. Siemens has listed this CVE among affected CVEs for its SIMATIC S7-1500 TM MFP GNU/Linux subsystem and recommends general security measures. [1][2]

References
  1. SSA-265688
  2. SSA-503939

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

165

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.