CVE-2026-89602
massOut-of-bounds pointer write in Linux kernel EROFS decompression buffer resize
The Linux kernel's EROFS filesystem mishandles the resizing of its global decompression buffer pool (z_erofs_gbuf): after a resize fails partway through, buffers that were already enlarged are revisited on retry, and retrying an intermediate size copies more page pointers into a temporary array than that array can hold, producing an out-of-bounds pointer write in kernel memory. The CVSS 3.1 vector (AV:L/PR:N/UI:R, score 7.8) indicates a local attack requiring no privileges but some user interaction, consistent with an unprivileged local user causing a crafted compressed EROFS image or a memory-pressure condition to trigger the failed-resize/retry path. Successful exploitation gives the attacker kernel memory corruption with high impact on confidentiality, integrity, and availability, which on a local system typically enables privilege escalation to root. Any installation running a kernel that contains the vulnerable EROFS decompression resize logic is affected. No public proof of concept is known, the CVE is not in CISA's KEV catalog, and there is no indication of exploitation in the wild.
What to do: Update to a kernel build from your distribution that includes the fix (upstream commit 'erofs: skip sufficiently large global buffers when resizing') as soon as it is packaged, since this is a high-severity (7.8) local memory-corruption issue. In the interim, restrict unprivileged users from mounting filesystems or processing untrusted EROFS images, and audit whether your fleet enables EROFS decompression (CONFIG_EROFS_FS_ZIP) and mounts EROFS images from untrusted sources to prioritize patching.
| Linux kernel (EROFS filesystem subsystem, z_erofs_gbuf resize path) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the guaranteed minimum size across the pool.
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.