What is the CVSS score of CVE-2026-23388?

CVE-2026-23388 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23388?

Yes, a patch is available for CVE-2026-23388. Update the affected software to the latest version immediately.

Linux CVE-2026-23388

EUVD-2026-15388 HIGH

Out-of-bounds Read (CWE-125)

2026-03-25 Linux

Linux Buffer Overflow Information Disclosure Red Hat

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SUSE

6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Red Hat

6.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:52 vuln.today

cvss_changed

CVSS changed

Apr 24, 2026 - 18:52 NVD

7.1 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 10:45 euvd

EUVD-2026-15388

Analysis Generated

Mar 25, 2026 - 10:45 vuln.today

CVE Published

Mar 25, 2026 - 10:28 nvd

N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check metadata block offset is within range

Syzkaller reports a "general protection fault in squashfs_copy_data"

This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset.

This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access.

The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases.

AnalysisAI

A metadata validation vulnerability in the Linux kernel's Squashfs filesystem implementation allows out-of-bounds memory access when processing corrupted or malicious filesystem images. Specifically, a negative metadata block offset derived from a corrupted index lookup table is passed to squashfs_copy_data without bounds checking, causing a general protection fault. Any Linux system mounting an untrusted Squashfs image is affected, potentially enabling denial of service or information disclosure attacks, though no active exploitation in the wild is currently documented.

Technical ContextAI

The vulnerability exists in the Squashfs filesystem driver, a compression-focused read-only filesystem commonly used in embedded systems, live bootable media, and container images. The root cause is improper input validation of metadata block offsets in the squashfs_read_metadata function. The affected Linux kernel (all versions identified via CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) fails to validate that offsets derived from the index lookup table fall within acceptable ranges before using them for memory access operations. This is fundamentally a bounds-checking failure (related to CWE-125: Out-of-bounds Read or similar memory safety issues) triggered by parsing a corrupted metadata structure. The Syzkaller fuzzer identified this during filesystem image mutation testing, demonstrating the vulnerability is reachable via specially crafted Squashfs images.

RemediationAI

Apply the latest kernel security updates provided by your Linux distribution. For mainline kernel users, upgrade to a kernel version that includes the fix (reference the commit hashes listed in references; these appear in kernels post-fix-date across stable branches). For distribution users, install kernel updates through your package manager (apt/yum/dnf) as soon as they are available. Until patching is possible, mitigate risk by: (1) avoiding mounting or executing untrusted Squashfs images from unknown sources, (2) restricting filesystem mount permissions to trusted administrators, and (3) disabling Squashfs driver support if not required (via kernel module blacklisting). Since this vulnerability is in the kernel's filesystem parsing layer and requires local access to trigger, reducing exposure to untrusted image sources is the primary interim mitigation. Monitor https://git.kernel.org/stable/ and your distribution's security advisories for patch availability.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2016-1646 HIGH POC

8.8

CVE-2025-5777 HIGH POC

7.5

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	5.10.223-1	-
bullseye (security)	vulnerable	5.10.251-1	-
bookworm	vulnerable	6.1.159-1	-
bookworm (security)	vulnerable	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-23388 vulnerability details – vuln.today

Back

Linux CVE-2026-23388

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code