ZeroHour

CVE-2026-89602

mass

Out-of-bounds pointer write in Linux kernel EROFS decompression buffer resize

CVSS 3.1
7.8 high
EPSS
Published
()
Modified
AI analysis

The Linux kernel's EROFS filesystem mishandles the resizing of its global decompression buffer pool (z_erofs_gbuf): after a resize fails partway through, buffers that were already enlarged are revisited on retry, and retrying an intermediate size copies more page pointers into a temporary array than that array can hold, producing an out-of-bounds pointer write in kernel memory. The CVSS 3.1 vector (AV:L/PR:N/UI:R, score 7.8) indicates a local attack requiring no privileges but some user interaction, consistent with an unprivileged local user causing a crafted compressed EROFS image or a memory-pressure condition to trigger the failed-resize/retry path. Successful exploitation gives the attacker kernel memory corruption with high impact on confidentiality, integrity, and availability, which on a local system typically enables privilege escalation to root. Any installation running a kernel that contains the vulnerable EROFS decompression resize logic is affected. No public proof of concept is known, the CVE is not in CISA's KEV catalog, and there is no indication of exploitation in the wild.

What to do: Update to a kernel build from your distribution that includes the fix (upstream commit 'erofs: skip sufficiently large global buffers when resizing') as soon as it is packaged, since this is a high-severity (7.8) local memory-corruption issue. In the interim, restrict unprivileged users from mounting filesystems or processing untrusted EROFS images, and audit whether your fleet enables EROFS decompression (CONFIG_EROFS_FS_ZIP) and mounts EROFS images from untrusted sources to prioritize patching.

Affected
Linux kernel (EROFS filesystem subsystem, z_erofs_gbuf resize path)
Estimated exposure
mass≈100M–1B+ devices (any kernel with the vulnerable EROFS code; realistically the compressed-EROFS-using subset, e.g. Android system partitions and… — The Linux kernel ships on billions of devices and EROFS (including its compression support) is enabled in most modern mainline distro kernels and used for Android read-only system partitions, so the population containing the vulnerable…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the guaranteed minimum size across the pool.

Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In the news

No ingested article mentions this CVE yet.