CVE-2026-23388

Vulnerability

Overview

In the Linux kernel's Squashfs filesystem driver, a corrupted index look-up table can produce a negative metadata block offset. This offset is passed to squashfs_read_metadata and subsequently to squashfs_copy_data, where the negative value triggers an out-of-bounds access. The issue was discovered by syzkaller, which reported a general protection fault in squashfs_copy_data [1].

Exploitation

An attacker can exploit this vulnerability by mounting a specially crafted Squashfs image. The attacker must be able to mount the filesystem, which could be achieved through a malicious USB drive, a downloaded image, or other means. No authentication is required beyond the ability to mount the filesystem. The kernel processes the corrupted metadata during mount or read operations, leading to the out-of-bounds access.

Impact

A successful exploit can cause a system crash (denial of service) due to the general protection fault. Additionally, the out-of-bounds read may leak sensitive kernel memory, potentially aiding further attacks. The CVSS v3 score of 7.1 (High) reflects the significant impact on availability and confidentiality.

Mitigation

The fix adds a range check in squashfs_read_metadata to validate the metadata block offset before use. Patches have been applied to multiple stable kernel branches [1][2][3][4]. Users should update their Linux kernel to a version containing the fix to mitigate this vulnerability.