Executive brief
A vulnerability in the Linux kernel's EROFS file system could allow a local user to crash the system or potentially gain unauthorized access. By using specially crafted, corrupted disk images, an attacker can trigger memory errors during file processing. This impact can lead to a complete system failure or the compromise of sensitive data stored on the machine.
Technical details
Two distinct issues exist within the EROFS file system's encoded extent handling introduced in Linux 6.15. First, improper validation of 'plen' values allowed sparse extents to be misinterpreted, leading to crashes. Second, a lack of sanity checks on 48-bit physical block addresses allowed an integer wrap-around during address calculations, resulting in an out-of-bounds access of the 'pcl->compressed_bvecs[]' array in 'z_erofs_submit_queue()'. An attacker with the ability to mount a crafted EROFS image can trigger these conditions to cause a Denial of Service (DoS) or potentially execute arbitrary code. The fix introduces a sanity check to enforce the 48-bit address limit and corrects the 'plen' mask logic in 'fs/erofs/zmap.c'.
Affected products
- Linux Linux Kernel 6.15 to 6.17.5
Timeline
- 2025-10-12: other: Patch authored
- 2025-12-04: disclosed: CVE published
- 2025-10-29: patched: Fix committed to stable tree