CVE-2026-90161: erofs: fix interlaced ztailpacking pclusters
Published Sep 17, 2026
·Updated
erofs: fix interlaced ztailpacking pclusters
Affected Software
1 affected component
The Linux Kernel Community Linux Kernel
Event History
Sep 17, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
DescriptionSeverity
Data Sourced
via NVD·05:17 PM
DescriptionSeverity
Sep 19, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Are normally created EROFS filesystems affected?
No. The data states that mkfs.erofs does not generate interlaced pclusters with ztailpacking enabled, so existing valid filesystems are not affected.
2
What would an attacker need to exploit this issue?
An attacker would need to provide a crafted EROFS image containing invalid interlaced ztailpacking pclusters. Processing that image can trigger an out-of-bounds read from a kmap'd page.
3
What is the potential impact of mounting or reading a crafted image?
Irrelevant kernel memory can be copied into page cache that is visible to userspace, creating a kernel-memory disclosure risk.