High 7.1Published Mar 25, 2026

CVE-2026-23388Squashfs: check metadata block offset is within range

Updated under an hour ago (Oct 27, 2026, 2:10 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset. This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access. The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f400e12656ab518be107febfe2315fb1eab5a342 before 60f679f643f3f36a8571ea585e4ce5d93ef952b5; from f400e12656ab518be107febfe2315fb1eab5a342 before 3f68a9457a6190814377577374da75f872e0a013; from f400e12656ab518be107febfe2315fb1eab5a342 before 0c8ab092aec3ac4294940054772d30b511b16713; from f400e12656ab518be107febfe2315fb1eab5a342 before 6b847d65f5b0065e02080c61fad93d57d6686383; from f400e12656ab518be107febfe2315fb1eab5a342 before 9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c; from f400e12656ab518be107febfe2315fb1eab5a342 before 01ee0bcc29864b78249308e8b35042b09bbf5fe3; from f400e12656ab518be107febfe2315fb1eab5a342 before 3b9499e7d677dd4366239a292238489a804936b2; from f400e12656ab518be107febfe2315fb1eab5a342 before fdb24a820a5832ec4532273282cbd4f22c291a0d	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.29.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 2.6.29; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/60f679f643f3f36a8571ea585e4ce5d93ef952b5	patch
https://git.kernel.org/stable/c/3f68a9457a6190814377577374da75f872e0a013	patch
https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713	patch
https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383	patch
https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c	patch
https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3	patch
https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2	patch
https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.