CVE-2026-80892: erofs: cap LZMA stream pool size
In the Linux kernel, the following vulnerability has been resolved:
erofs: cap LZMA stream pool size
fs/erofs/decompressorlzma.c sizes the module-global MicroLZMA stream pool from numpossiblecpus() when the lzmastreams module parameter is unset, then zerofsloadlzmaconfig() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new CONFIGEROFSFSZIPLZMADEFAULTMAXSTREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzmastreams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS to 16 to cap the default LZMA stream pool size (reduces vmalloc-backed decoder-state pinning by limiting the stream pool).
Linux kernel erofs LZMA decompressor (fs/erofs/decompressor_lzma.c) CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS = 16
Event History
Frequently Asked Questions
Which systems are most exposed to excessive memory use?
Systems that mount EROFS images using LZMA compression are exposed, particularly high-CPU systems where the default stream pool was derived from the number of possible CPUs. A small image can retain up to 8 MiB of vmalloc-backed decoder state for each stream until the erofs module is unloaded.
Does an explicitly configured lzma_streams value avoid the new limit?
Yes. An explicit lzma_streams module parameter continues to be honored as configured; the new limit applies to the default stream count when that parameter is unset.
What is the default memory bound after the fix?
The new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option defaults to 16 streams. Where the system has at least 16 CPUs, this bounds default preallocation to 128 MiB while retaining the 8 MiB per-image dictionary limit.