CVE-2026-23388: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23388 is an out-of-bounds read vulnerability in the Linux kernel's Squashfs subsystem, caused by insufficient validation of metadata block offsets. A corrupted Squashfs index look-up table can produce a negative metadata block offset, which is passed unchecked to squashfs_copy_data via squashfs_read_metadata, resulting in an out-of-bounds memory access. The vulnerability was disclosed on March 25, 2026, and affects Linux kernel versions from 2.6.29 through multiple current stable branches, as well as Microsoft Azure Linux kernel 6.6.126.1-1. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Feedly).

The root cause is improper validation of a specified index/offset value (CWE-1285) leading to an out-of-bounds read (CWE-125). When the Squashfs driver processes a corrupted filesystem image, the index look-up table can yield a negative metadata block offset; this value is passed directly to squashfs_read_metadata without a bounds check, and subsequently to squashfs_copy_data, where it causes a general protection fault due to an out-of-bounds memory access. The fix adds an explicit range check in squashfs_read_metadata to reject invalid offsets before they propagate. Exploitation requires a local attacker with low privileges to supply or mount a crafted, corrupted Squashfs filesystem image (Red Hat CVE, Feedly).

Successful exploitation by a local low-privileged attacker can result in kernel crashes (denial of service) and disclosure of sensitive kernel memory contents. There is also potential for privilege escalation depending on what kernel memory is exposed or how the out-of-bounds read can be further leveraged. The vulnerability affects a broad range of Linux kernel versions spanning from 2.6.29 through current stable branches (up to 6.19 before 6.19.7), impacting a wide variety of Linux distributions and embedded systems that use Squashfs (Feedly, Red Hat CVE).

Patches are available across multiple stable kernel branches. Users should upgrade to one of the following fixed versions: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or 7.0-rc2+. Patch commits are available in the upstream kernel stable tree (e.g., 01ee0bcc, 0c8ab092, 3b9499e7, and others). As a workaround where patching is not immediately feasible, restrict or audit access to mounting untrusted Squashfs filesystem images and validate filesystem sources before mounting (Red Hat CVE, Feedly, Red Hat Bugzilla).