CVE-2026-89778 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
isofs: fix out-of-bounds page array access on empty zisofs block
zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which
"if (poffset && *pages)" reads pages[1] out of bounds. rock.c only
rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image.
Return the byte count relative to poffset and zero only [poffset, PAGE_SIZE) of the first page, matching the decompression path.
The page-aligned case (poffset == 0) is unaffected.
BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofs_read_folio (fs/isofs/compress.c:290) read_pages (mm/readahead.c:184) ... filemap_read (mm/filemap.c:2814) vfs_read (fs/read_write.c:574) __x64_sys_pread64 (fs/read_write.c:769) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains a critical out-of-bounds memory access vulnerability within the ISO9660 filesystem implementation, specifically affecting the zisofs decompression logic. This flaw resides in the function zisofs_uncompress_block and is triggered when processing empty blocks of compressed data under specific alignment conditions. The root cause lies in an inconsistency between how the fast path for empty blocks calculates byte counts versus how the standard decompression path handles them. When a block is identified as empty, the code returns pcount shifted left by PAGE_SHIFT bits to represent bytes produced. However, this calculation ignores the incoming page offset parameter, which indicates where within the current memory page the data should begin. In contrast, the normal decompression path correctly accounts for this offset when determining how many bytes are actually generated relative to that starting position.
This discrepancy becomes problematic during sequential reads of compressed files on ISO9660 images mounted with zisofs support. The function zisofs_fill_pages relies on the return value from the uncompression routine to advance its internal page cursor, which tracks progress through an array of memory pages allocated for reading file data. If a sub-page block leaves poffset partway into a current page, and is immediately followed by an empty block, the incorrect calculation causes the system to over-count the number of bytes produced. Consequently, the page cursor advances one element past the end of the allocated pages array. Subsequent code then attempts to access this invalid memory location via the check if poffset exists and *pages, resulting in a slab-out-of-bounds read error detected by Kernel Address Sanitizer during runtime testing.
The vulnerability can be exploited through ordinary file system operations rather than requiring complex privilege escalation or specialized tools. An attacker needs only to create an ISO9660 image containing Rock Ridge extensions with crafted ZF records that set the block size shift value below PAGE_SHIFT, ensuring sub-page alignment issues arise. When a user process performs a standard read operation on a compressed file within such an archive, it triggers the faulty code path. The resulting out-of-bounds access allows for potential information disclosure or kernel instability depending on what data resides immediately after the allocated region in the kmalloc-8 cache. While rock.c restricts block size shifts to values greater than seventeen, this constraint is insufficient to prevent scenarios where alignment mismatches occur with smaller effective block sizes relative to page boundaries.
From a security classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read and falls under the ATT&CK technique of Tactic Execution or Impact depending on whether the out-of-bounds read leads to code execution via subsequent exploitation chains such as use-after-free scenarios in adjacent memory regions. The impact ranges from denial of service through kernel panic to potential remote information disclosure if an attacker can control mount parameters remotely, although local access is typically required for ISO9660 mounting unless automounting features are enabled with untrusted media sources. Mitigation strategies include applying the upstream Linux kernel patch that corrects zisofs_uncompress_block to return byte counts relative to poffset and ensures zero-filling occurs only within valid page boundaries matching the decompression path behavior. System administrators should ensure their distributions apply this fix promptly, particularly for systems handling untrusted optical media or network-mounted ISO images using compressed filesystem features.