CVE-2026-89602: erofs: skip sufficiently large global buffers when resizing
In the Linux kernel, the following vulnerability has been resolved:
erofs: skip sufficiently large global buffers when resizing
zerofsgbufnrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers.
Retrying the same size then returns -ENOMEM because allocpagesbulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold.
Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing zerofsgbufnrpages again describes the guaranteed minimum size across the pool.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the issue?
The issue requires a failed attempt to resize EROFS global buffers after some buffers have already been enlarged, followed by a retry. A retry at the same size can incorrectly fail with -ENOMEM, while a retry at an intermediate size can copy existing pointers into an undersized temporary array.
What is the practical impact before the fix?
Affected resize retries can fail even when no additional pages need to be allocated. Intermediate-size retries can overrun the temporary pointer array because it is smaller than the number of pointers copied.
How can the issue be mitigated if the fix cannot be applied immediately?
The provided information does not identify a configuration workaround. Avoiding failed global-buffer resize attempts and subsequent resize retries would avoid the described trigger path.