CVE-2026-80899: erofs: remove fscache backend entirely
In the Linux kernel, the following vulnerability has been resolved:
erofs: remove fscache backend entirely
EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years.
As EROFS file-backed mounts and fanotify pre-content hooks both upstream for a while and already providing equivalent functionality (erofs-utils has supported fanotify pre-content hooks), let's remove the fscache backend now.
The main application of this feature is Nydus [1], and they plan to move to use fanotify pre-content hooks in the near future too.
I hope this patch can be merged into Linux 7.2, which is also motivated by newly found implementation issues [2][3] that are not worth investigating given the deprecation and limited development resources. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later: it seems fine since the codebase is isolated by CONFIGCACHEFILESONDEMAND.
[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md [2] https://github.com/dragonflyoss/nydus/pull/1824 [3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Linux kernel fscache backend for EROFS (erofs: remove fscache backend entirely)from your environment.Remove the fscache backend entirely from the Linux kernel EROFS integration (as described: “erofs: remove fscache backend entirely”).
- Configuration
Ensure the fscache/cachefiles functionality is not used outside the CONFIG_CACHEFILES_ONDEMAND isolation context; the text notes the fscache backend is “isolated by CONFIG_CACHEFILES_ONDEMAND,” so remove/disable usage of that backend accordingly.
Linux kernel CONFIG_CACHEFILES_ONDEMAND = isolated by CONFIG_CACHEFILES_ONDEMAND (implying not enabled/used)
Event History
Frequently Asked Questions
Which deployments are most likely to be affected?
Deployments using EROFS over fscache for image lazy pulling are the relevant population. The description identifies Nydus as the main application of this feature.
What should operators use instead of the removed backend?
EROFS file-backed mounts and fanotify pre-content hooks are described as equivalent functionality. erofs-utils already supports fanotify pre-content hooks, and Nydus plans to move to them.
How can I determine whether this applies to my environment?
Check whether your image lazy-pulling workflow uses EROFS over fscache. If it does not use that backend, the described removal does not apply to that workflow.