CVE-2026-89602: erofs: skip sufficiently large global buffers when resizing

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

erofs: skip sufficiently large global buffers when resizing

zerofsgbufnrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers.

Retrying the same size then returns -ENOMEM because allocpagesbulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold.

Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing zerofsgbufnrpages again describes the guaranteed minimum size across the pool.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
Description

Frequently Asked Questions

1

What conditions are needed to trigger the issue?

The issue requires a failed attempt to resize EROFS global buffers after some buffers have already been enlarged, followed by a retry. A retry at the same size can incorrectly fail with -ENOMEM, while a retry at an intermediate size can copy existing pointers into an undersized temporary array.

2

What is the practical impact before the fix?

Affected resize retries can fail even when no additional pages need to be allocated. Intermediate-size retries can overrun the temporary pointer array because it is smaller than the number of pointers copied.

3

How can the issue be mitigated if the fix cannot be applied immediately?

The provided information does not identify a configuration workaround. Avoiding failed global-buffer resize attempts and subsequent resize retries would avoid the described trigger path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203