CVE-2026-4426: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-4426 is a denial-of-service vulnerability in libarchive caused by undefined behavior in the zisofs decompression logic of the ISO9660 Rock Ridge extension parser. The flaw stems from improper validation of the pz_log2_bs field, which is read directly from a crafted ISO file and used as a shift exponent without bounds checking. Affected software includes libarchive (all versions prior to the fix), and downstream products including Red Hat Enterprise Linux 6.0–10.0, Red Hat OpenShift Container Platform 4.0, and Red Hat Hardened Images. The vulnerability was reported on March 19, 2026, and a fix was merged into the libarchive master branch on April 12, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-1335 (Incorrect Bitwise Shift of Integer). In parse_rockridge(), the one-byte field pz_log2_bs is read from the ISO9660 Rock Ridge ZF extension entry at line 2761 (file->pz_log2_bs = data[3]) with no validation, accepting values 0–255. The zisofs specification only permits values 15, 16, or 17 (for 32K/64K/128K block sizes). In zisofs_read_data(), this value is used directly in shift expressions: (size_t)1UL << zisofs->pz_log2_bs (line 1549) and ((int64_t)1) << zisofs->pz_log2_bs (lines 1527–1530). On 64-bit systems, a value ≥ 64 triggers undefined behavior per C11 §6.5.7; on 32-bit systems, a large exponent causes the block pointer allocation size to overflow to near-zero, resulting in a heap buffer overflow write after malloc(0). The fix, contributed via GitHub PR #2897, validates pz_log2_bs immediately after reading it and disables zisofs for the entry if the value is outside [15, 17] (GitHub PR, Red Hat Bugzilla).

Successful exploitation results in a denial-of-service condition: applications that process ISO images using libarchive may crash due to incorrect memory allocation, bogus loop bounds, or heap buffer overflow writes triggered by the undefined behavior. The vulnerability has no confidentiality or integrity impact (CVSS C:N/I:N/A:H), but availability is fully compromised for affected processes. Any service or application that automatically processes user-supplied ISO files — such as archive managers, backup tools, or container image builders — is at risk of being crashed by a malicious ISO (Red Hat CVE, GitHub PR).

The vulnerability requires user interaction (e.g., a user or automated process opening a crafted ISO file), but no authentication or special privileges are needed. No public exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.00113 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The issue was discovered through fuzzing with ASAN/UBSAN and responsibly disclosed (Red Hat CVE, GitHub PR).

1. Craft a malicious ISO file: Using a Python script or similar tool, construct an ISO9660 image with a Rock Ridge ZF extension entry where the pz_log2_bs byte (offset 3 in the ZF entry data) is set to a value ≥ 64 (e.g., 64, 128, or 255) to trigger undefined behavior on 64-bit systems, or a large value on 32-bit systems to cause heap overflow.
2. Deliver the ISO to the target: Distribute the crafted ISO via email attachment, file share, web download, or any channel where the target application will process it (e.g., an archive manager, backup tool, or container image processor using libarchive).
3. Trigger processing: Induce the target application to open or extract the ISO file. This may happen automatically (e.g., auto-mount, automated backup scan) or require the user to open the file.
4. Achieve DoS: When libarchive's zisofs_read_data() processes the ZF entry, the unvalidated pz_log2_bs value is used in a shift expression, triggering undefined behavior, incorrect memory allocation, and an application crash (GitHub PR, Red Hat Bugzilla).

• File System: Presence of unexpected or externally sourced ISO files in directories monitored by applications using libarchive; ISO files with anomalous Rock Ridge ZF extension entries (detectable via ISO analysis tools).
• Logs: Application crash logs or core dumps from processes using libarchive (e.g., bsdtar, bsdcat, archive managers); UBSAN/ASAN runtime error messages referencing archive_read_support_format_iso9660.c:1549 with messages such as shift exponent 64 is too large for 64-bit type 'long unsigned int'.
• Process: Unexpected termination (segfault, abort) of applications processing ISO files; repeated crashes of archive-handling daemons or services after receiving new ISO files (GitHub PR).

The fix is included in libarchive version 3.8.7, which validates pz_log2_bs in parse_rockridge_ZF1() and rejects values outside the spec-defined range [15, 17]. Red Hat has issued RHSA-2026:8944 providing libarchive 3.8.7-1 for Red Hat Hardened Images (aarch64, x86_64). Debian has issued DLA-4563-1 for LTS users, and Ubuntu has issued USN-8292-1. SUSE has released SUSE-SU-2026:21757-1. Users should upgrade libarchive to version 3.8.7 or later as soon as possible. As a workaround where patching is not immediately possible, avoid processing untrusted ISO files with applications that use libarchive (Red Hat Errata, GitHub PR).

The vulnerability received routine coverage from Linux distribution security channels, including Debian, Ubuntu, SUSE, and openSUSE security announcements. The Yocto Project security mailing list also flagged the issue for embedded Linux users. Coverage was largely technical and focused on patch availability, with no notable controversy or high-profile researcher commentary identified (Debian LTS, Ubuntu USN, SUSE Advisory).