Executive brief
The Linux kernel's EROFS file system uses LZMA compression to store and decompress files. On systems with many CPU cores, mounting an EROFS image could cause excessive memory consumption (hundreds of MB) due to unbounded allocation of decompression stream buffers. This can degrade system performance or cause out-of-memory conditions until the file system is unmounted.
Technical details
The vulnerability exists in fs/erofs/decompressor_lzma.c, which sizes the module-global MicroLZMA stream pool based on num_possible_cpus() when the lzma_streams module parameter is unset. Each decompression stream preallocates one dictionary of up to 8 MiB from vmalloc memory. On high-CPU systems (e.g., 128+ cores), this results in hundreds of MB being locked in memory until the erofs module is unloaded. The attack vector is local (mounting a malicious EROFS image), and no authentication is required. The fix introduces a CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS kernel configuration option (default 16) that caps the default stream count, bounding worst-case preallocation to 128 MiB while preserving administrator control via module parameter override.
Affected products
- Linux Linux kernel 5.16 and later (before fix commit c9b47e6b23114e939b17f818471c7a46e59006e7)
Timeline
- 2026-09-04: disclosed: CVE-2026-80892 published
- 2026-08-09: patched: Patch commit c9b47e6b23114e939b17f818471c7a46e59006e7 signed by Greg Kroah-Hartman