CVE-2026-97605: erofs: preserve LZMA decoders on resize failure

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

erofs: preserve LZMA decoders on resize failure

The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is put back on the list with state == NULL. zerofslzmamaxdictsize is still advanced as if the whole pool had been resized.

An existing LZMA mount can select the broken stream and pass NULL to xzdecmicrolzmareset(). A retry at the same size also skip another resize attempt. Since the global maximum was advanced, thus, the invalid state is left unrepaired.

Allocate each replacement before freeing the old decoder, temporarily retaining one old decoder during allocation. Stop at the first failure and advance zerofslzmamaxdictsize only after all streams satisfy the request.

Record each stream's dictionary capacity so retries can skip streams already enlarged before a partial failure.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What conditions are required to trigger the issue?

The failure requires an EROFS filesystem using LZMA compression and a decoder-pool resize where allocation of a replacement decoder fails after at least some streams have already been replaced. An existing LZMA mount must then select the stream whose decoder state was left NULL.

2

What is the impact after a partial decoder-pool resize failure?

A stream can remain in the pool with a NULL decoder state while the global maximum dictionary size indicates that resizing completed. Subsequent use of that stream can pass NULL to xz_dec_microlzma_reset(), and retries at the same size do not repair the invalid state.

3

How does the fix prevent the broken state from persisting?

The fix allocates a replacement decoder before freeing the existing one and advances the global maximum dictionary size only after every stream meets the requested capacity. It also records per-stream dictionary capacity so a retry can enlarge only streams not already resized.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203