In the Linux kernel, the following vulnerability has been resolved:

erofs: fix use-after-free on sbi->syncdecompress

zerofsdecompresskickoff() can race with filesystem unmount, causing a use-after-free on sbi->syncdecompress.

When I/O completes, zerofsendio() calls zerofsdecompresskickoff() to queue zerofsdecompressqueuework() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->syncdecompress.

Thread (unmount) I/O completion kworker queuework zerofsdecompressqueuework (all folios are unlocked) cleanupmnt .. erofskillsb erofssbfree kfree(sbi) access sbi->syncdecompress // UAF!!

erofs: unify lcn as u64 for 32-bit platforms

erofs: fix unsigned underflow in zerofslz4handleoverlap()

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix incorrect early exits in volume label handling

Crafted EROFS images containing valid volume labels can trigger incorrect early returns, leading to folio reference leaks.

However, this does not cause system crashes or other severe issues.

erofs: add GFPNOIO in the bio completion if needed