CVE-2026-90161: erofs: fix interlaced ztailpacking pclusters
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix interlaced ztailpacking pclusters
On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all.
Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems.
However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.
Affected Software
Event History
Frequently Asked Questions
Are normally created EROFS filesystems affected?
No. The data states that mkfs.erofs does not generate interlaced pclusters with ztailpacking enabled, so existing valid filesystems are not affected.
What would an attacker need to exploit this issue?
An attacker would need to provide a crafted EROFS image containing invalid interlaced ztailpacking pclusters. Processing that image can trigger an out-of-bounds read from a kmap'd page.
What is the potential impact of mounting or reading a crafted image?
Irrelevant kernel memory can be copied into page cache that is visible to userspace, creating a kernel-memory disclosure risk.