CVE-2026-98879 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
isofs: handle set_blocksize failures
isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The isofs filesystem implementation within the Linux kernel contains a critical flaw related to block size handling during mount operations. This vulnerability stems from an insufficient check of return values when attempting to set the file system's internal block size via the set_blocksize function. The underlying technical issue arises because buffer_heads, which are fundamental data structures used by isofs for managing disk blocks, do not correctly handle scenarios where the requested block size exceeds PAGE_SIZE. This architectural limitation creates a dangerous state if the kernel proceeds with operations assuming a valid and manageable block configuration that actually violates internal memory constraints.
When an attacker or user attempts to mount an isofs image with specific parameters that trigger this condition, the system fails to validate whether the set_blocksize operation succeeded before proceeding. Consequently, subsequent calls to functions like __bread_gfp attempt to access buffer heads in a context where the offset exceeds the folio size. This mismatch triggers a BUG_ON assertion within the folio_set_bh function, specifically checking if the offset is greater than or equal to the folio_size. The execution of this assertion results in an immediate kernel panic, causing a complete system crash and denial of service for all processes running on the affected machine.
From a security perspective, this vulnerability represents a classic example of improper input validation leading to resource management errors. It aligns with CWE-252, which covers unchecked return values, as the code fails to verify if set_blocksize returned an error or success state before relying on its side effects. Furthermore, because it allows for local denial of service through mount operations, it relates to CWE-400 regarding uncontrolled resource consumption and potentially CWE-789 concerning memory corruption due to out-of-bounds access triggers via the assertion failure. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Local Denial of Service (T1529) by allowing a local user with mount privileges to crash the host system through crafted file systems or specific mounting parameters.
The operational impact is severe for any environment relying on isofs stability and integrity. A successful exploitation leads to an immediate kernel panic, requiring a hard reboot of the affected server or workstation. This disrupts availability and can lead to data loss if unsaved work exists in memory at the time of the crash. For systems where isofs is used for embedded devices, optical media handling, or legacy system compatibility, this flaw poses a significant risk to uptime and reliability.
Mitigation strategies primarily involve applying the upstream kernel patch that resolves this issue by properly checking the return value of set_blocksize. Administrators should ensure their Linux distributions are updated with the latest stable kernel versions containing this fix. Additionally, restricting mount privileges to trusted users can reduce the attack surface until patches are deployed. Monitoring for unusual system reboots or kernel logs indicating BUG_ON failures in folio_set_bh can help identify potential exploitation attempts or misconfigurations that trigger this flaw.