CVE-2026-23388
Squashfs: check metadata block offset is within range
Reported by linux · Published March 25, 2026
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset. This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access. The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel6.12-libbpf | Amazon Linux | 1:6.12.77-99.140.amzn2023 |
| kernel-livepatch-6.12.77-99.140 | Amazon Linux | 1:1.0-0.amzn2023 |
| perf6.12 | Amazon Linux | 1:6.12.77-99.140.amzn2023 |
| kernel | Amazon Linux | 1:6.1.168-202.320.amzn2023 |
| kernel6.18-devel | Amazon Linux | 1:6.18.20-20.229.amzn2023 |
| kernel6.18-tools | Amazon Linux | 1:6.18.20-20.229.amzn2023 |
| kernel6.18-libbpf | Amazon Linux | 1:6.18.20-20.229.amzn2023 |
| kernel6.12-tools-devel | Amazon Linux | 1:6.12.77-99.140.amzn2023 |
| kernel-tools | Amazon Linux | 1:6.1.168-202.320.amzn2023 |
| kernel6.12 | Amazon Linux | 1:6.12.77-99.140.amzn2023 |
| kernel6.18-libbpf-static | Amazon Linux | 1:6.18.20-20.229.amzn2023 |
| kernel6.18-modules-extra-common | Amazon Linux | 1:6.18.20-20.229.amzn2023 |
11 more packages have a fixed version. See every fix in Lookup.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | f400e12656ab518be107febfe2315fb1eab5a342, f400e12656ab518be107febfe2315fb1eab5a342, f400e12656ab518be107febfe2315fb1eab5a342 |
| Linux | Linux | 2.6.29, 0, 5.10.253 |
| amazon:2023 | kernel6.12-libbpf | 0 |
| amazon:2023 | kernel-livepatch-6.12.77-99.140 | 0 |
| amazon:2023 | perf6.12 | 0 |
| amazon:2023 | kernel | 0 |
| amazon:2023 | kernel6.18-devel | 0 |
| amazon:2023 | kernel6.18-tools | 0 |
| amazon:2023 | kernel6.18-libbpf | 0 |
| amazon:2023 | kernel6.12-tools-devel | 0 |
| amazon:2023 | kernel-tools | 0 |
| amazon:2023 | kernel6.12 | 0 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | 0 |
| amazon:2023 | kernel6.18-libbpf-static | 0 |
| amazon:2023 | kernel6.18-modules-extra-common | 0 |
| amazon:2023 | kernel6.12-libbpf-static | 0 |
| amazon:2023 | kernel-headers | 0 |
| amazon:2023 | kernel-libbpf-static | 0 |
| amazon:2023 | perf | 0 |
| amazon:2023 | kernel6.18-libbpf-devel | 0 |
…and 27 more
Timeline
- Mar 24, 2026 CVE Published
- Mar 25, 2026 EPSS Score (23 in total, the first dated here)
- Mar 25, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 25, 2026 PoC Published (4 in total, the first dated here)
- Mar 31, 2026 Security Advisory (142 in total, the first dated here)
- Apr 24, 2026 CVE Updated
- Aug 11, 2026 Distribution Patch (59 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-23388
vulnetix vdb fixes CVE-2026-23388Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-23388/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart