The Linux kernel's Squashfs filesystem code had a vulnerability where reading a negative block offset (e.g., into a decompressed fragment block) caused the function squashfs_copy_data() to perform an out-of-bounds memory access. Exploitation requires mounting a specially crafted Squashfs filesystem, which requires CAP_SYS_ADMIN privileges. Once mounted, unprivileged users can trigger the vulnerability by reading files with the negative offset. The fix involves validating the offset to ensure it is not negative and returning zero bytes copied if it is, aligning with existing behavior for offsets beyond the block.

Successful exploitation can lead to out-of-bounds memory access, potentially resulting in denial of service or information disclosure. The vulnerability requires privileged access to mount the malicious filesystem, but unprivileged users can trigger the out-of-bounds read after mounting. The CVSS score of 7.1 reflects high impact on confidentiality and availability.

A fix is available that adds a check for negative offsets in the Squashfs code, returning zero bytes copied to prevent out-of-bounds access. Users should apply the official Linux kernel update that includes this patch. Since mounting the crafted filesystem requires CAP_SYS_ADMIN, restricting administrative privileges also mitigates risk. No further action is required once the patch is applied.