Executive brief
A race condition was identified in the Linux kernel's EROFS file system when handling specific types of compressed data. This flaw could potentially lead to system instability or memory management errors when multiple processes attempt to access the same cached data simultaneously. The issue specifically affects systems using unaligned data compression, such as certain Zstd configurations.
Technical details
A race condition exists in fs/erofs/zdata.c within the EROFS file system implementation. When handling unaligned compressed extents, a folio might be added to the file map (filemap_add_folio) before its private data is updated. This allows a second thread to find the same folio in z_erofs_bind_cache() and attempt to add it again, as the folio->private field still indicates it is preallocated. The vulnerability is triggered during concurrent access to unaligned data compression (e.g., using -E48bit with zstd). The fix involves explicitly clearing folio->private before the folio becomes visible in the managed cache, forcing subsequent threads to wait on the locked folio.
Affected products
- Linux Linux Kernel 6.15 to 7.1
Timeline
- 2026-04-28: disclosed: Vulnerability reported and patch authored
- 2026-07-19: advisory: CVE-2026-64031 published by NVD