Executive brief
A vulnerability was identified in the Linux kernel's EROFS file system, which is often used in mobile devices and embedded systems for read-only data. On 32-bit systems, a technical error in how the system calculates file locations could lead to data being truncated or accessed incorrectly when files exceed 4GB in size. This could potentially lead to system instability or data corruption for users of older or specialized 32-bit hardware.
Technical details
An integer overflow/truncation vulnerability exists in the EROFS (Enhanced Read-Only File System) implementation within the Linux kernel. On 32-bit architectures, the logical cluster number (lcn) was previously defined as 'unsigned long' or 'unsigned int', which are 32 bits wide. When performing bitwise shifts to calculate offsets (lcn << lclusterbits), the result would truncate at the 4 GiB boundary. This issue affects the zmap.c component during logical-to-physical cluster mapping. An attacker with the ability to mount or access a specially crafted EROFS image could potentially trigger this behavior, leading to incorrect data reads or kernel errors. The fix unifies the 'lcn' type to 'u64' across the codebase to ensure 64-bit precision regardless of the underlying CPU architecture.
Affected products
- Linux Linux 5.3 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-04-20: disclosed: Vulnerability reported by sashiko
- 2026-06-24: advisory: CVE-2026-53015 published by NVD