In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check metadata block offset is within range

Syzkaller reports a "general protection fault in squashfs_copy_data"

This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.

This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.

The fix is to check that the offset is within range in
squashfs_read_metadata. This will trap this and other cases.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f400e12656ab518be107febfe2315fb1eab5a342 affected < 0c8ab092aec3ac4294940054772d30b511b16713
f400e12656ab518be107febfe2315fb1eab5a342 affected < 6b847d65f5b0065e02080c61fad93d57d6686383
f400e12656ab518be107febfe2315fb1eab5a342 affected < 9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c
f400e12656ab518be107febfe2315fb1eab5a342 affected < 01ee0bcc29864b78249308e8b35042b09bbf5fe3
f400e12656ab518be107febfe2315fb1eab5a342 affected < 3b9499e7d677dd4366239a292238489a804936b2
f400e12656ab518be107febfe2315fb1eab5a342 affected < fdb24a820a5832ec4532273282cbd4f22c291a0d
Linux Linux affected
Version Status Constraints
2.6.29 affected —
0 unaffected < 2.6.29
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.77 unaffected ≤ 6.12.*
6.18.17 unaffected ≤ 6.18.*
6.19.7 unaffected ≤ 6.19.*
7.0-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3 cve-icon cve-icon
https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713 cve-icon cve-icon
https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2 cve-icon cve-icon
https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383 cve-icon cve-icon
https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c cve-icon cve-icon
https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d cve-icon cve-icon
History

Wed, 25 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset. This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access. The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases.
Title Squashfs: check metadata block offset is within range
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-03-25T10:28:06.224Z

Reserved: 2026-01-13T15:37:46.008Z

Link: CVE-2026-23388

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-03-25T11:16:39.280

Modified: 2026-03-25T11:16:39.280

Link: CVE-2026-23388

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.