Executive brief
A vulnerability was identified in the Linux kernel's EROFS file system, which is often used in read-only environments like mobile devices or embedded systems. The system failed to correctly handle data requests that went past the end of the file system, which could lead to unpredictable behavior or potential data leakage. This issue has been resolved by ensuring that any such requests are properly cleared and returned as zeros.
Technical details
A vulnerability in the EROFS file system component of the Linux kernel (specifically in fs/erofs/fileio.c) resulted from improper handling of I/O requests that exceed the filesystem boundary on file-backed mounts. In such scenarios, the kernel should zero-fill the remaining buffer to prevent the exposure of stale memory or uninitialized data, similar to the behavior of loopback devices. The fix modifies erofs_fileio_ki_complete to ensure that if the returned bytes (ret) do not match the requested BIOS size, the remaining portion is explicitly zeroed using zero_fill_bio. This prevents potential information disclosure or kernel instability when accessing malformed or edge-case file-backed EROFS images.
Affected products
- Linux Linux Kernel Fixed in versions containing commit bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc
Timeline
- 2026-01-30: other: Patch authored by Gao Xiang
- 2026-06-09: disclosed: CVE published by NVD