Executive brief
The EROFS filesystem implementation in the Linux kernel had a flaw where page cache sharing could be set up with incomplete file path information. When certain system calls like mincore() tried to access this missing path information, the kernel would crash with a null pointer dereference, causing system instability and potential denial of service.
Technical details
The vulnerability is a null pointer dereference in the EROFS filesystem's page cache sharing feature. The erofs_ishare_fill_inode() function was creating backing files for shared page caches with an uninitialized f_path structure (containing only f_inode). When mincore() tried to access f_path.mnt, it dereferenced a null pointer at address 0x18, triggering a kernel BUG. The root cause was improper initialization of the file structure used for shared inodes. The fix involves using d_obtain_alias() to create valid disconnected dentries and using the erofs_ishare_mnt mount point, ensuring that standard backing_file_open() can work correctly. The vulnerability affects kernels starting from at least 7.2-rc4 and is resolved through proper initialization of the file path structure.
Affected products
- Linux Linux kernel 7.2-rc4 and prior versions with EROFS_FS_PAGE_CACHE_SHARE enabled
Timeline
- 2026-08-28: disclosed: CVE-2026-80697 published
- 2026-07-27: patched: Fix committed upstream by Gao Xiang
- 2026-08-09: patched: Fix merged to stable kernel by Greg Kroah-Hartman