---
id: CVE-2026-89778
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  isofs: fix out-of-bounds page array access on empty zisofs block

  zisofs_uncompress_block()'s empty-block fast path returns
  pcount << PAGE_SHIFT, ignoring the incoming …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  isofs: fix out-of-bounds page array access on empty zisofs block

  zisofs_uncompress_block()'s empty-block fast path returns
  pcount << PAGE_SHIFT, ignoring the incoming …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    8b994ac5778a725982fd6a8a3afcaa068d4a93e3
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    85904076cece72ee3194646ad7ac8e6659d999aa
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    f03425dcbe04aec3c27b9917e97d7d23a2908dda
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    cd616aa0449a772a6956abf03358f0ff31720580
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    9c6eace8d07e90f038c89eb3b756d65a7e259d48
  - >-
    Linux >= 59bc055211b8d266ab6089158058bf8268e02006 <
    68d4d3e78150c7ed7d1195af63ad1e6ace30c661
  - Linux 2.6.33
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:07.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89778'
references:
  - url: 'https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T08:52:29.594Z'
epss: 0.00688
epssPercentile: 0.51317
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

isofs: fix out-of-bounds page array access on empty zisofs block

zisofs_uncompress_block()'s empty-block fast path returns
pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the
decompression path which returns bytes produced relative to poffset.
zisofs_fill_pages() uses that return to advance its page cursor, so when
the zisofs block size is below PAGE_SIZE and a sub-page block leaves
poffset partway into a page, a following empty block over-counts and
advances pages[] one element past its end, after which
"if (poffset && *pages)" reads pages[1] out of bounds.  rock.c only
rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can
set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a
compressed file on such a mounted ISO9660 image.

Return the byte count relative to poffset and zero only
[poffset, PAGE_SIZE) of the first page, matching the decompression path.
The page-aligned case (poffset == 0) is unaffected.

  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)
  Read of size 8 at addr ffff88800f5eac48 by task exploit/142
   zisofs_read_folio (fs/isofs/compress.c:290)
   read_pages (mm/readahead.c:184)
   ...
   filemap_read (mm/filemap.c:2814)
   vfs_read (fs/read_write.c:574)
   __x64_sys_pread64 (fs/read_write.c:769)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  The buggy address is located 0 bytes to the right of the
  allocated 8-byte region in the kmalloc-8 cache

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.