CVE-2026-89778 Overview
CVE-2026-89778 is an out-of-bounds read vulnerability in the Linux kernel's isofs filesystem, specifically within the zisofs compressed ISO9660 handling code. The flaw resides in zisofs_uncompress_block(), where the empty-block fast path returns pcount << PAGE_SHIFT while ignoring the incoming poffset argument. When the zisofs block size is smaller than PAGE_SIZE, zisofs_fill_pages() advances its page cursor incorrectly and reads pages[1] past the end of the allocated array. An attacker can trigger the condition by mounting a crafted ISO9660 image with a malicious Rock Ridge ZF record and performing a normal read() on a compressed file.
Critical Impact
A crafted ISO9660 image can cause a slab out-of-bounds read in the kernel, enabling denial of service or potential kernel information disclosure via ordinary file reads.
Affected Products
- Linux kernel isofs filesystem with zisofs compression support
- Distributions shipping vulnerable stable kernel branches referenced by the upstream fix commits
- Systems that auto-mount removable or user-supplied ISO9660 media
Discovery Timeline
- 2026-09-16 - CVE-2026-89778 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89778
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in the kernel path that handles compressed ISO9660 (zisofs) reads. The decompression path in zisofs_uncompress_block() returns byte counts relative to the caller-supplied poffset. The empty-block fast path does not. Instead, it returns pcount << PAGE_SHIFT, over-counting the bytes produced when poffset is nonzero.
The caller, zisofs_fill_pages(), uses that return value to advance its page cursor across the pages[] array. When the zisofs block size shift is below PAGE_SHIFT, a sub-page block can leave poffset partway into the current page. A subsequent empty block then advances the cursor one element past the end of pages[]. The following check if (poffset && *pages) dereferences pages[1], reading eight bytes past the allocation. KASAN observes the fault in the kmalloc-8 cache at zisofs_read_folio (fs/isofs/compress.c:290).
Root Cause
The root cause is inconsistent return-value semantics between the two branches of zisofs_uncompress_block(). The empty-block fast path ignores poffset and zeros full pages, while the decompression path correctly returns bytes relative to poffset. Additionally, rock.c only rejects a block-size shift greater than 17, permitting values below PAGE_SHIFT in the Rock Ridge ZF record.
Attack Vector
Exploitation requires an attacker-controlled ISO9660 image mounted on the target system. Any read() or pread64() against a compressed file whose ZF record encodes a sub-PAGE_SIZE block will trigger the out-of-bounds access. This maps to physical-media insertion, USB attacks, or network shares that deliver ISO images auto-mounted by desktop environments or automated pipelines. No credentials are required if the mount is performed by a privileged helper on user insertion.
The vulnerability manifests during the read syscall path: __x64_sys_pread64 → vfs_read → filemap_read → read_pages → zisofs_read_folio. See the upstream fix commits referenced below for the corrected byte-count arithmetic and page-zeroing bounds.
Detection Methods for CVE-2026-89778
Indicators of Compromise
- KASAN reports of slab-out-of-bounds reads in zisofs_read_folio at fs/isofs/compress.c in kernel logs
- Unexpected kernel oops, panics, or task crashes correlated with iso9660 mount events
- Presence of ISO9660 images containing Rock Ridge ZF records with block-size shift values below PAGE_SHIFT (typically below 12)
Detection Strategies
- Audit dmesg and journalctl -k for KASAN messages referencing zisofs_uncompress_block or zisofs_fill_pages
- Monitor mount syscalls for iso9660 filesystem types originating from untrusted media or user sessions
- Inventory hosts running vulnerable kernel builds by cross-referencing installed kernel versions against the upstream fix commits
Monitoring Recommendations
- Enable kernel crash reporting (kdump, systemd-coredump) to capture backtraces containing zisofs_read_folio
- Alert on repeated ISO9660 mount attempts from removable media on servers and workstations
- Forward kernel logs to a centralized SIEM for correlation of KASAN or oops signatures across the fleet
How to Mitigate CVE-2026-89778
Immediate Actions Required
- Apply the upstream kernel patches listed in the Patch Information section as soon as vendor builds become available
- Disable auto-mounting of removable ISO9660 media on servers and multi-user systems
- Restrict mount privileges so unprivileged users cannot mount attacker-supplied ISO images
Patch Information
Upstream fixes correct zisofs_uncompress_block() to return the byte count relative to poffset and to zero only the range [poffset, PAGE_SIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected. Fix commits: 68d4d3e, 85904076, 8b994ac5, 9c6eace8, ad3249cd, cd616aa0, f03425dc.
Workarounds
- Blacklist the isofs kernel module on hosts that do not require ISO9660 support using echo 'blacklist isofs' > /etc/modprobe.d/blacklist-isofs.conf
- Configure udev and desktop session policies to prevent automatic mounting of optical media and ISO image files
- Enforce mount options that reject user-supplied filesystem images and require administrator approval for ISO9660 mounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
