Executive brief
A vulnerability was identified in the Linux kernel's EROFS file system, which is often used in mobile devices and embedded systems for efficient data storage. Under specific conditions, such as when a system signal interrupts a data read operation, the system may experience a crash (NULL pointer dereference). This could lead to a denial-of-service (DoS) scenario where the device or server becomes unresponsive and requires a reboot.
Technical details
A vulnerability in the EROFS file system driver in the Linux kernel arises from improper handling of ztailpacking pclusters. Specifically, compressed folios must be validated before being added to I/O chains; otherwise, the z_erofs_decompress_pcluster() function may assume they are valid and attempt to access them, resulting in a NULL pointer dereference. This race condition is difficult to trigger but can occur if a fatal signal interrupts read_mapping_folio() during execution. The fix involves ensuring inline data is read before allocating and adding pclusters to I/O chains. The issue was addressed in the zdata.c component.
Affected products
- Linux Linux Kernel erofs component
Timeline
- 2026-02-03: other: Patch authored by Gao Xiang
- 2026-05-27: disclosed: CVE published