CVE-2026-90203 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check block offset is not negative
If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access.
Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied.
To trigger this out of bounds access requires a crafted Squashfs filesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be able to mount such a filesystem, but once mounted, an unprivileged user can trigger the out of bounds access by reading the crafted file with the negative offset.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's SquashFS implementation contains a critical input validation flaw within the data copying mechanism that allows for out-of-bounds memory access under specific conditions. This vulnerability arises from an insufficient check on block offsets during the decompression and retrieval of filesystem blocks. Specifically, when processing metadata or file content, if a crafted Squashfs image presents a negative value as the offset into a decompressed fragment block, the kernel fails to validate this parameter before proceeding with memory operations. The function squashfs_copy_data() is responsible for handling these data transfers, but without proper bounds checking on signed integer values representing offsets, it may interpret the negative number in an unintended manner due to type conversion or arithmetic underflow issues inherent in C programming when dealing with unsigned types or pointer arithmetic.
This technical flaw leads directly to a heap-based out-of-bounds read vulnerability. When the kernel attempts to access memory at an address calculated using this invalid negative offset, it reads data from outside the intended buffer boundaries. While the immediate impact is often limited to information disclosure through potential leakage of adjacent kernel memory contents, such vulnerabilities can sometimes be chained with other flaws or exploited in specific contexts to achieve arbitrary code execution if combined with additional primitives like use-after-free conditions or heap grooming techniques. The severity is compounded by the fact that SquashFS is frequently used in embedded systems and read-only environments where security boundaries might be less rigorously enforced compared to general-purpose operating system distributions.
The exploitation of this vulnerability requires a specific set of circumstances due to Linux kernel privilege models. An attacker must first possess CAP_SYS_ADMIN capabilities or root privileges to mount the malicious Squashfs filesystem image, as mounting arbitrary filesystems is restricted by default security policies. However, once the crafted filesystem is successfully mounted, any unprivileged user on the system can trigger the vulnerability simply by attempting to read a file contained within that specific filesystem structure. This characteristic means that while initial access requires elevated privileges for setup, the actual exploitation phase does not require further privilege escalation beyond standard user rights, potentially allowing lateral movement or denial of service through kernel panic if the out-of-bounds read corrupts critical memory structures.
From a classification perspective, this issue aligns with CWE-125 Out-of-bounds Read and CWE-682 Incorrect Calculation due to its reliance on improper handling of numerical inputs leading to invalid memory access patterns. In terms of attack vectors, it falls under ATT&CK technique T1074 Data Localized Staging if the attacker uses the mounted filesystem for storage, but more critically relates to initial exploitation via local privilege escalation paths where an actor leverages existing high-level privileges to load malicious code structures that then affect lower-privileged processes. The vulnerability highlights a common class of bugs in kernel subsystems where input validation is performed inconsistently across different entry points or data types.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that introduces explicit checks for negative offset values within the SquashFS driver logic. System administrators should ensure their systems are updated with the latest stable kernel versions containing this fix, particularly those deploying embedded devices or container images based on Squashfs layers where such filesystems are prevalent. Additionally, enforcing strict mount policies and limiting CAP_SYS_ADMIN capabilities to only essential services can reduce the attack surface by preventing unauthorized users from mounting potentially malicious filesystem structures in the first place. Regular auditing of kernel configurations and timely application of security patches remain critical defenses against this class of memory safety vulnerabilities.