Executive brief
EROFS is a read-only compressed filesystem used in embedded systems and container images. A flaw in handling crafted filesystem images with interlaced ztailpacking data allows an attacker to read out-of-bounds kernel memory and expose it through the page cache. This could leak sensitive kernel information from a system that mounts an untrusted EROFS image.
Technical details
The vulnerability exists in the EROFS decompression and mapping logic (fs/erofs/decompressor.c and fs/erofs/zmap.c). Interlaced pclusters (physical clusters) with ztailpacking should be rejected as invalid, but the kernel failed to enforce this check. An attacker can craft a malicious EROFS image containing such invalid interlaced ztailpacking pclusters. When the filesystem is mounted, the decompression code performs an out-of-bounds read from a kmap'd page, copying unintended kernel memory into the userspace-visible page cache. The fix adds a block-alignment assertion (DBG_BUGON) in the decompression path and adds a metadata flag check to reject interlaced pclusters in certain contexts. The attack requires the ability to create or provide a crafted EROFS image that is then mounted on the target system.
Affected products
- Linux Linux kernel 5.4 and later (kernels supporting EROFS interlaced pcluster feature)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-08-14: patched: Fix committed upstream by Gao Xiang
- 2026-09-14: patched: Fix backported to stable trees