CVE-2026-97605: erofs: preserve LZMA decoders on resize failure
In the Linux kernel, the following vulnerability has been resolved:
erofs: preserve LZMA decoders on resize failure
The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is put back on the list with state == NULL. zerofslzmamaxdictsize is still advanced as if the whole pool had been resized.
An existing LZMA mount can select the broken stream and pass NULL to xzdecmicrolzmareset(). A retry at the same size also skip another resize attempt. Since the global maximum was advanced, thus, the invalid state is left unrepaired.
Allocate each replacement before freeing the old decoder, temporarily retaining one old decoder during allocation. Stop at the first failure and advance zerofslzmamaxdictsize only after all streams satisfy the request.
Record each stream's dictionary capacity so retries can skip streams already enlarged before a partial failure.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The failure requires an EROFS filesystem using LZMA compression and a decoder-pool resize where allocation of a replacement decoder fails after at least some streams have already been replaced. An existing LZMA mount must then select the stream whose decoder state was left NULL.
What is the impact after a partial decoder-pool resize failure?
A stream can remain in the pool with a NULL decoder state while the global maximum dictionary size indicates that resizing completed. Subsequent use of that stream can pass NULL to xz_dec_microlzma_reset(), and retries at the same size do not repair the invalid state.
How does the fix prevent the broken state from persisting?
The fix allocates a replacement decoder before freeing the existing one and advances the global maximum dictionary size only after every stream meets the requested capacity. It also records per-stream dictionary capacity so a retry can enlarge only streams not already resized.