CVE-2026-90203 Squashfs: check block offset is not negative
A crafted Squashfs filesystem can cause an out-of-bounds access in the Linux kernel, potentially leading to denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-90203?
CVE-2026-90203 is a high-severity memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check block offset is not negative
If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access.
Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied.
To trigger this out of bounds access requires a crafted Squashfs filesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be able to mount such a filesystem, but once mounted, an unprivileged user can trigger the out of bounds access by reading the crafted file with the negative offset.
Which versions are affected by CVE-2026-90203?
How do I fix CVE-2026-90203?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90203 being exploited?
There is no known exploitation of CVE-2026-90203 in the wild and no public exploit code.
Sources
Also known as AZL-102374, BELL-CVE-2026-90203, DEBIAN-CVE-2026-90203, GHSA-3vc4-628m-7f5q, UBUNTU-CVE-2026-90203.