Unscored severity · published Oct 23, 2026
CVE-2026-98879
isofs: handle set_blocksize failures
New
–
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
isofs: handle set_blocksize failures
isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6db7f0ba365786304558db6a3d52013ae176e03e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 61f277bf35f533b602984f0e55900111fe52f31a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cebde6d88e34396c29f2f001d90e921677cc17d6; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 28d1f6aa14f5924e36602b7a31c9141d34de0b9c; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9c97e3b1152d3092581745189f5d2f04c6404ef9; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9584ab6283721e5aab485c79bd06c2f78d89e55c; +2 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-98879
git.kernel.org
https://git.kernel.org/stable/c/25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32
git.kernel.org
https://git.kernel.org/stable/c/28d1f6aa14f5924e36602b7a31c9141d34de0b9c
git.kernel.org
https://git.kernel.org/stable/c/61f277bf35f533b602984f0e55900111fe52f31a
git.kernel.org
https://git.kernel.org/stable/c/6db7f0ba365786304558db6a3d52013ae176e03e
git.kernel.org
https://git.kernel.org/stable/c/9584ab6283721e5aab485c79bd06c2f78d89e55c
git.kernel.org
https://git.kernel.org/stable/c/9c97e3b1152d3092581745189f5d2f04c6404ef9
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place