Executive brief
A vulnerability in the Linux kernel's EROFS file system could allow an attacker to crash the system or potentially access sensitive information. This occurs when the system processes a specially crafted compressed disk image. Users who mount untrusted storage media or disk images are at the highest risk.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the EROFS file system component of the Linux kernel, specifically within the z_erofs_transform_plain() function. The root cause is an incorrect identification of interlaced plain extents; the kernel failed to verify that both the start position and the on-disk physical length were aligned to the block size. An attacker can exploit this by providing a crafted compressed EROFS image containing plain extents with unaligned physical lengths. This can lead to a system crash (denial of service) or the leakage of kernel memory. Patches have been released for various stable branches including 6.18.x and 6.19.x.
Affected products
- Linux Linux Kernel 6.15 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-02-24: other: Vulnerability fixed in source code
- 2026-05-06: disclosed: CVE assigned and published
- 2026-05-13: advisory: NVD analysis updated