CVE-2026-89778

The Linux kernel's isofs zisofs decompressor mishandles empty compression blocks: a crafted "ZF" Rock Ridge record inside an ISO9660 image can set the compression block size below the kernel page size, and an ordinary read() of such a compressed file then drives zisofs_read_folio() one entry past the end of the allocated page-pointer array (KASAN reports a slab-out-of-bounds 8-byte read immediately past an 8-byte kmalloc-8 allocation, i.e. a single-entry array). An attacker triggers this by supplying a specially crafted ISO image that a user or automated service mounts and then reads; the page-aligned case (poffset == 0) is unaffected. An attacker gains kernel out-of-bounds memory access, potentially yielding information disclosure or a kernel crash, and the assigned CVSS 3.1 score is 9.8 critical, though the practical trigger requires mounting an attacker-controlled image rather than a purely remote path. Any Linux system that mounts untrusted ISO9660 images with ISO9660/zisofs support enabled is affected, including desktops handling removable media, CI/build and VM services that mount ISOs, and file managers with auto-mount. No public proof-of-concept or confirmed in-the-wild exploitation is known; the flaw is fixed by the upstream commit "isofs: fix out-of-bounds page array access on empty zisofs block," and no affected/fixed version ranges are specified in the available data.

What to do: Update the kernel to a release that includes the upstream fix "isofs: fix out-of-bounds page array access on empty zisofs block" once it reaches your distribution's stable channel; no fixed version numbers are available in the current data, so track your vendor's advisory. Until patched, avoid mounting ISO images from untrusted sources and restrict or disable automatic mounting of removable media and ISO files by unprivileged users. Verify whether your kernel is built with CONFIG_ISO9660_FS/CONFIG_ZISOFS; images using page-aligned blocks (poffset == 0) are unaffected.