{"id":"CVE-2026-98636","summary":"squashfs: Add dictionary size range check to prevent shift-out-of-bounds","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsquashfs: Add dictionary size range check to prevent shift-out-of-bounds\n\nWhen an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size\nis 0) is mounted, and performs shift operations using dictionarysize, the\nshift exponent is -1, causing a shift-out-of-bounds.\n\nDetail as below:\nsquashfs_comp_opts(msblk, buffer, length)\n  squashfs_xz_comp_opts()\n    if (comp_opts)\n      n = ffs(opts-\u003edict_size) - 1;\u003c----opts-\u003edict_size=0, n=-1\n      if (opts-\u003edict_size != (1 \u003c\u003c n) && opts-\u003edict_size !=\n\t  \t(1 \u003c\u003c n) + (1 \u003c\u003c (n + 1))) \u003c----shift-out-of-bounds\n\nFix it by adding a dictionary size range check before the shift operation.","modified":"2026-10-19T02:47:00.570801741Z","published":"2026-10-18T15:20:07.184Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98636.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0cb85377daaefb4ce5ce72975f2deb27ee0e0cad"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1f7745fb3580152ca902ef181b605f33cabfb1d0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/88c673a0bd233df44ca0020da82f4fd3876de27a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9d9c5c218ea356a1d88765214ad2919605280ab1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b02948a23455f8190a53887b2d2c13ae1d360cea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c68e0068a236f9a7dfc19720bdf11e5d80a85089"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e1ca4e3a380ef3e8f46ce006f1146392e3f32c98"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98636.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98636"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ff750311d30acc9564ef577050794953eee59f01"},{"fixed":"b02948a23455f8190a53887b2d2c13ae1d360cea"},{"fixed":"9d9c5c218ea356a1d88765214ad2919605280ab1"},{"fixed":"7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1"},{"fixed":"c68e0068a236f9a7dfc19720bdf11e5d80a85089"},{"fixed":"88c673a0bd233df44ca0020da82f4fd3876de27a"},{"fixed":"0cb85377daaefb4ce5ce72975f2deb27ee0e0cad"},{"fixed":"e1ca4e3a380ef3e8f46ce006f1146392e3f32c98"},{"fixed":"1f7745fb3580152ca902ef181b605f33cabfb1d0"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98636.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.39"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.112"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.55"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98636.json"}}],"schema_version":"1.9.0"}