CVE-2026-98636

A flaw was found in the SquashFS file system implementation in the Linux kernel. A local user could exploit this vulnerability by mounting a specially crafted SquashFS image with an invalid dictionary size. Processing this image triggers an invalid shift operation, leading to a kernel crash and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires local access with elevated privileges (such as CAP_SYS_ADMIN) to mount untrusted storage images. In standard Red Hat Enterprise Linux deployments, non-privileged users cannot mount arbitrary filesystem images unless specific automount or delegation mechanisms are enabled. The defect leads to a kernel crash and subsequent denial of service, without granting arbitrary code execution or disclosing confidential data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.