{"api_version":"1","generated_at":"2026-09-17T15:01:40+00:00","cve":"CVE-2026-89778","urls":{"html":"https://cve.report/CVE-2026-89778","api":"https://cve.report/api/cve/CVE-2026-89778.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89778","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89778"},"summary":{"title":"isofs: fix out-of-bounds page array access on empty zisofs block","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bounds page array access on empty zisofs block\n\nzisofs_uncompress_block()'s empty-block fast path returns\npcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the\ndecompression path which returns bytes produced relative to poffset.\nzisofs_fill_pages() uses that return to advance its page cursor, so when\nthe zisofs block size is below PAGE_SIZE and a sub-page block leaves\npoffset partway into a page, a following empty block over-counts and\nadvances pages[] one element past its end, after which\n\"if (poffset && *pages)\" reads pages[1] out of bounds.  rock.c only\nrejects a block-size shift > 17, so a crafted \"ZF\" Rock Ridge record can\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a\ncompressed file on such a mounted ISO9660 image.\n\nReturn the byte count relative to poffset and zero only\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.\nThe page-aligned case (poffset == 0) is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)\n  Read of size 8 at addr ffff88800f5eac48 by task exploit/142\n   zisofs_read_folio (fs/isofs/compress.c:290)\n   read_pages (mm/readahead.c:184)\n   ...\n   filemap_read (mm/filemap.c:2814)\n   vfs_read (fs/read_write.c:574)\n   __x64_sys_pread64 (fs/read_write.c:769)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address is located 0 bytes to the right of the\n  allocated 8-byte region in the kmalloc-8 cache","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 09:17:08","updated_at":"2026-09-16 15:18:07"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a","name":"https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3","name":"https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661","name":"https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda","name":"https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa","name":"https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580","name":"https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48","name":"https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89778","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89778","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 8b994ac5778a725982fd6a8a3afcaa068d4a93e3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 85904076cece72ee3194646ad7ac8e6659d999aa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 f03425dcbe04aec3c27b9917e97d7d23a2908dda git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 cd616aa0449a772a6956abf03358f0ff31720580 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 9c6eace8d07e90f038c89eb3b756d65a7e259d48 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bc055211b8d266ab6089158058bf8268e02006 68d4d3e78150c7ed7d1195af63ad1e6ace30c661 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.33","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.33 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"89778","cve":"CVE-2026-89778","epss":"0.002050000","percentile":"0.108070000","score_date":"2026-09-16","updated_at":"2026-09-17 00:07:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/isofs/compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8b994ac5778a725982fd6a8a3afcaa068d4a93e3","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"},{"lessThan":"ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"},{"lessThan":"85904076cece72ee3194646ad7ac8e6659d999aa","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"},{"lessThan":"f03425dcbe04aec3c27b9917e97d7d23a2908dda","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"},{"lessThan":"cd616aa0449a772a6956abf03358f0ff31720580","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"},{"lessThan":"9c6eace8d07e90f038c89eb3b756d65a7e259d48","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"},{"lessThan":"68d4d3e78150c7ed7d1195af63ad1e6ace30c661","status":"affected","version":"59bc055211b8d266ab6089158058bf8268e02006","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/isofs/compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"2.6.33","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bounds page array access on empty zisofs block\n\nzisofs_uncompress_block()'s empty-block fast path returns\npcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the\ndecompression path which returns bytes produced relative to poffset.\nzisofs_fill_pages() uses that return to advance its page cursor, so when\nthe zisofs block size is below PAGE_SIZE and a sub-page block leaves\npoffset partway into a page, a following empty block over-counts and\nadvances pages[] one element past its end, after which\n\"if (poffset && *pages)\" reads pages[1] out of bounds.  rock.c only\nrejects a block-size shift > 17, so a crafted \"ZF\" Rock Ridge record can\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a\ncompressed file on such a mounted ISO9660 image.\n\nReturn the byte count relative to poffset and zero only\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.\nThe page-aligned case (poffset == 0) is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)\n  Read of size 8 at addr ffff88800f5eac48 by task exploit/142\n   zisofs_read_folio (fs/isofs/compress.c:290)\n   read_pages (mm/readahead.c:184)\n   ...\n   filemap_read (mm/filemap.c:2814)\n   vfs_read (fs/read_write.c:574)\n   __x64_sys_pread64 (fs/read_write.c:769)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address is located 0 bytes to the right of the\n  allocated 8-byte region in the kmalloc-8 cache"}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - isofs assigns s_export_op to isofs_export_ops; nfsd_read then nfsd_iter_read (vfs_iocb_iter_read) and ksmbd_vfs_read (kernel_read) perform VFS reads that reach generic_file_read_iter, filemap_read, and zisofs_read_folio, so a remote NFS or SMB client can trigger the bug on a host exporting a crafted ISO9660 image.\nAC:L - The attacker fully controls the Rock Ridge ZF parms (rock.c only rejects block_shift > 17) and the zisofs block pointer table; a block_shift below PAGE_SHIFT plus a nonempty sub-page block followed by an empty block (block_start==block_end) deterministically over-advances pages[] with no race.\nPR:N - A remote NFS or SMB client needs only read access to an exported iso9660 tree; AUTH_SYS media-server exports commonly require no host credentials, and compressed regular files default to S_IRUGO. No CAP_SYS_ADMIN on the victim host is required on the read path.\nUI:N - Once an iso9660 volume containing the crafted zisofs file is exported, the NFS or SMB server processes the client's READ automatically; no separate victim must open a file or click a dialog at attack time beyond that pre-existing export.\nS:U - The slab out-of-bounds pointer load and any memzero_page or SetPageUptodate side effects remain inside the host kernel; this is not a VM escape, IOMMU/DMA bypass, or other cross-authority boundary.\nC:H - zisofs_fill_pages loads an 8-byte pointer from one slot past a kmalloc-8 pages[] allocation and may treat adjacent heap data as a struct page. With heap grooming this memory corruption can be turned into a kernel information-disclosure primitive, so confidentiality impact is High.\nI:H - When the out-of-bounds pointer is non-NULL, memzero_page() writes zeros through kmap_local_page() of the forged page and SetPageUptodate() corrupts page flags, yielding a kernel write primitive against attacker-groomed heap or page objects that can be chained to control-flow hijack.\nA:H - KASAN reports a slab-out-of-bounds read in zisofs_read_folio; feeding a non-page pointer to kmap_local_page or memzero_page oopses or panics the kernel, and the attacker can repeat the NFS, SMB, or local read at will."}]}],"providerMetadata":{"dateUpdated":"2026-09-16T14:38:29.867Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3"},{"url":"https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a"},{"url":"https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa"},{"url":"https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda"},{"url":"https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580"},{"url":"https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48"},{"url":"https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661"}],"title":"isofs: fix out-of-bounds page array access on empty zisofs block","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89778","datePublished":"2026-09-16T08:48:18.407Z","dateReserved":"2026-09-11T19:38:34.765Z","dateUpdated":"2026-09-16T14:38:29.867Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 09:17:08","lastModifiedDate":"2026-09-16 15:18:07","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89778","Ordinal":"1","Title":"isofs: fix out-of-bounds page array access on empty zisofs block","CVE":"CVE-2026-89778","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89778","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bounds page array access on empty zisofs block\n\nzisofs_uncompress_block()'s empty-block fast path returns\npcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the\ndecompression path which returns bytes produced relative to poffset.\nzisofs_fill_pages() uses that return to advance its page cursor, so when\nthe zisofs block size is below PAGE_SIZE and a sub-page block leaves\npoffset partway into a page, a following empty block over-counts and\nadvances pages[] one element past its end, after which\n\"if (poffset && *pages)\" reads pages[1] out of bounds.  rock.c only\nrejects a block-size shift > 17, so a crafted \"ZF\" Rock Ridge record can\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a\ncompressed file on such a mounted ISO9660 image.\n\nReturn the byte count relative to poffset and zero only\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.\nThe page-aligned case (poffset == 0) is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)\n  Read of size 8 at addr ffff88800f5eac48 by task exploit/142\n   zisofs_read_folio (fs/isofs/compress.c:290)\n   read_pages (mm/readahead.c:184)\n   ...\n   filemap_read (mm/filemap.c:2814)\n   vfs_read (fs/read_write.c:574)\n   __x64_sys_pread64 (fs/read_write.c:769)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address is located 0 bytes to the right of the\n  allocated 8-byte region in the kmalloc-8 cache","Type":"Description","Title":"isofs: fix out-of-bounds page array access on empty zisofs block"}]}}}