In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an… (CVE-2026-98636)

The Linux kernel's SquashFS component had a vulnerability where an abnormal SquashFS image with COMP_OPTS flag set to 1 and a dictionary size of 0 caused a shift operation with a negative exponent (-1), resulting in a shift-out-of-bounds error. Specifically, the function squashfs_comp_opts called squashfs_xz_comp_opts, which used the dictionary size in a bit-shift operation without validating that the dictionary size was non-zero and within a valid range. The fix involved adding a dictionary size range check before performing the shift to prevent out-of-bounds shifts.

This vulnerability could cause the kernel to perform an invalid bit-shift operation when mounting a specially crafted SquashFS image, potentially leading to undefined behavior such as crashes or memory corruption. The exact impact beyond this is not detailed in the provided information.

A fix has been implemented by adding a dictionary size range check before the shift operation in the SquashFS code. Users should apply the official Linux kernel update that includes this patch once available. Since no patch links or vendor advisory are provided, check the Linux kernel official repositories or advisories for the fix status. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.