CVE-2026-90203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90203
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90203.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90203
Downstream
Published
2026-09-17T16:07:20Z
Modified
2026-09-19T03:47:25Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Squashfs: check block offset is not negative
Details

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check block offset is not negative

If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access.

Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied.

To trigger this out of bounds access requires a crafted Squashfs filesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be able to mount such a filesystem, but once mounted, an unprivileged user can trigger the out of bounds access by reading the crafted file with the negative offset.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90203.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f400e12656ab518be107febfe2315fb1eab5a342
Fixed
b169185d5c672b989985c6c2e38cafab2548ba88
Fixed
c2a126fca820ae74872da28de68dc74d4595dc4b
Fixed
95dadf366c117dcdca78a570e6832071deab1ecd
Fixed
3d2f0cb66c909ea2312cdef465165bb9a3ba2d84
Fixed
bbb2218eb072b0a15dc063929200183bd23c2344
Fixed
d0a3729d464fcf516416a41cf304c0c92126ee03
Fixed
e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe
Fixed
e300eb5002925b29be803d2661af07266cfa267e

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90203.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.29
Fixed
5.10.270
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.221
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.157
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90203.json"