CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents
erofs: fix the out-of-bounds nameoff handling for trailing dirents
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
An attacker needs to induce processing of a crafted EROFS filesystem containing a trailing directory entry with an invalid name offset. A nameoff value at or beyond the directory block maximum size can underflow the length calculation and make strnlen() read beyond the directory block.
Is remote exploitation implied by the CVSS vector?
No. The CVSS vector lists local attack vector (AV:L) and user interaction required (UI:R). The supplied data indicates an attacker needs local access and user interaction, rather than describing a network-reachable attack path.
What malformed filesystem structures are relevant when assessing exposure?
Relevant indicators are trailing EROFS directory entries with nameoff values greater than or equal to the applicable maximum size, and an initial nameoff value that is not aligned to sizeof(struct erofs_dirent). These conditions are specifically addressed by the fix.
Which listed software is affected?
The affected software list includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. The provided data does not identify a fixed version range.