Executive brief
The Linux kernel's EROFS (Enhanced Read-Only File System) contains a bug in its global buffer resizing logic that can trigger memory allocation failures and buffer overflows. When resizing fails partway through, retrying the operation may cause the kernel to attempt copying more data than an allocated array can hold, or fail to allocate additional memory. This could lead to kernel panics, data corruption, or system instability on systems using EROFS-formatted storage.
Technical details
The vulnerability exists in the z_erofs_gbuf_growsize() function in fs/erofs/zutil.c. The root cause is that z_erofs_gbuf_nrpages is only advanced after all global buffers have been enlarged. If a resize operation fails partway through, a retry revisits already-enlarged buffers and attempts to resize them again. When retrying the same size, alloc_pages_bulk() returns -ENOMEM because there are no pages to add, and this is treated as a failure. If retrying an intermediate size, a temporary pointer array smaller than gbuf->nrpages is allocated, then more existing pointers are copied to it than it can hold, causing a buffer overflow. The fix skips buffers that already satisfy the resize request size. The vulnerability affects Linux kernel stable versions 6.10 and later. No network access or special privileges are required; local code execution or denial of service is achievable by triggering the resizing path, likely via filesystem operations on EROFS volumes.
Affected products
- Linux Linux Kernel 6.10+
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-09-21: patched: Patch commit 3fbdd15d5830f52661eb78be95058d101cb0c2cb merged to stable
- 2026-09-11: patched: Patch commit 7267557ce98ccd07faaf3bc86382448950cc4ff6 merged