CVE-2026-98005: erofs: delimit inode_share cache key components
In the Linux kernel, the following vulnerability has been resolved:
erofs: delimit inodeshare cache key components
Previously, inodeshare keys were encoded as follows:
fingerprint || domainid
It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won't be parsed as part of a domain ID.
Change the key encoding as follows:
domainid || '\0' || fingerprint
Since domainid is a NUL-terminated string, this makes the in-memory key indices unambiguous.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Delimit the inode_share cache key components with a separator so the fingerprint and domain_id indices are unambiguous.
Linux kernel erofs inode_share cache inode_share key encoding = fingerprint || '\0' || domain_id
Event History
Frequently Asked Questions
What condition makes a system relevant to this issue?
The issue is relevant to Linux kernel systems using EROFS inode_share cache keys that combine a domain ID and fingerprint. The ambiguity arises because the prior in-memory encoding concatenated the fingerprint and domain ID without a delimiter.
What is required for the cache-key ambiguity to occur?
A domain ID and fingerprint must produce a concatenated key in which fingerprint data can be parsed as part of the domain ID. The provided data does not specify an attacker access level, input path, or configuration prerequisite.
How is the issue resolved?
The resolved encoding changes the key layout to domain_id followed by a NUL separator and then the fingerprint. Because the domain ID is NUL-terminated, the separator makes the in-memory key indices unambiguous.