{"id":24435,"date":"2026-09-16T20:32:18","date_gmt":"2026-09-16T12:32:18","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89778"},"modified":"2026-09-16T20:32:18","modified_gmt":"2026-09-16T12:32:18","slug":"cve-2026-89778","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89778","title":{"rendered":"CVE-2026-89778 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bou"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>isofs: fix out-of-bounds page array access on empty zisofs block<\/p>\n<p>zisofs_uncompress_block()&#8217;s empty-block fast path returns<br \/>\npcount &lt; 17, so a crafted &#8220;ZF&#8221; Rock Ridge record can<br \/>\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a<br \/>\ncompressed file on such a mounted ISO9660 image.<\/p>\n<p>Return the byte count relative to poffset and zero only<br \/>\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.<br \/>\nThe page-aligned case (poffset == 0) is unaffected.<\/p>\n<p>  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs\/isofs\/compress.c:290)<br \/>\n  Read of size 8 at addr ffff88800f5eac48 by task exploit\/142<br \/>\n   zisofs_read_folio (fs\/isofs\/compress.c:290)<br \/>\n   read_pages (mm\/readahead.c:184)<br \/>\n   &#8230;<br \/>\n   filemap_read (mm\/filemap.c:2814)<br \/>\n   vfs_read (fs\/read_write.c:574)<br \/>\n   __x64_sys_pread64 (fs\/read_write.c:769)<br \/>\n   do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)<br \/>\n   entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<br \/>\n  The buggy address is located 0 bytes to the right of the<br \/>\n  allocated 8-byte region in the kmalloc-8 cache<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>isofs: fix out-of-bounds page array access on empty zisofs block<\/p>\n<p>zisofs_uncompress_block()&#8217;s empty-block fast path returns<br \/>\npcount <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24435","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}