CVE-2026-98636: squashfs: Add dictionary size range check to prevent shift-out-of-bounds

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds. Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds Fix it by adding a dictionary size range check before the shift operation.

Affected products

Linux kernel: 2.6.39 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98636 or the next vulnerability affects your stack