Executive brief
A vulnerability was identified in the Linux kernel's EROFS file system, which is often used in read-only environments like mobile devices or embedded systems. An attacker could use a specially crafted file system image to cause the system to crash or read memory outside of intended boundaries. This could lead to a denial-of-service, impacting the availability of the affected device.
Technical details
An out-of-bounds read vulnerability exists in the EROFS file system driver (fs/erofs/dir.c) due to improper boundary checking of 'nameoff' values in trailing directory entries. When processing a crafted EROFS image where a trailing dirent has a nameoff greater than or equal to the maximum size, an integer underflow occurs during the calculation of the remaining buffer length (maxsize - nameoff). This underflow causes strnlen() to read past the allocated directory block. Additionally, the fix ensures nameoff is a multiple of the directory entry structure size. The vulnerability can be triggered by mounting and reading a malicious EROFS image, potentially leading to a kernel panic or information leakage from adjacent memory.
Affected products
- Linux Linux Kernel Fixed in 5.10.216, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9+
Timeline
- 2026-04-21: other: Patch authored
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366
- https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789
- https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4
- https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214
- https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575