CVE-2026-80697: erofs: ensure valid f_path for page cache sharing
In the Linux kernel, the following vulnerability has been resolved:
erofs: ensure valid fpath for page cache sharing
Previously, backing files for page cache sharing were set up with fpath left as NULL (only finode was valid). It worked, but a recent mincore fix relies on fpath.mnt and crashes (found by "erofs/028" on 7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy) Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 RIP: 0010:dosysmincore+0xc0/0x2c0 ...
Specify valid paths using valid disconnected dentries together with erofsisharemnt instead of leaving fpath empty, so they are more like real backing files in a pseudo filesystem and standard backingfileopen() can be used directly.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
The affected system must use EROFS page cache sharing with backing files whose f_path was left NULL. A mincore operation can then dereference the missing mount path and cause a kernel NULL-pointer crash.
How can I identify a likely occurrence of this issue?
The reported failure is a kernel NULL pointer dereference in __do_sys_mincore, with the faulting address shown as 0x18. The issue was reproduced by the erofs/028 test using fincore.
What does the fix change?
The fix gives page-cache-sharing backing files valid paths, using disconnected dentries with erofs_ishare_mnt, rather than leaving f_path empty. It also allows standard backing_file_open() to be used directly.