{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90161","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.790Z","datePublished":"2026-09-17T16:06:52.470Z","dateUpdated":"2026-09-18T17:53:29.404Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-18T17:53:29.404Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced ztailpacking pclusters\n\nOn-disk sizes of interlaced pclusters should be block-aligned, and\nztailpacking interlaced pclusters should be invalid at all.\n\nCurrently, mkfs.erofs won't generate any interlaced pcluster with\nztailpacking enabled, so this doesn't affect any existing valid\nfilesystems.\n\nHowever, crafted images can contain invalid interlaced ztailpacking\npclusters, resulting in an out-of-bounds read from a kmap'd page and\ncopying irrelevant kernel memory into userspace-visible page cache."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The malformed bytes are on-disk in z_erofs_map_header.h_advise (Z_EROFS_ADVISE_INTERLACED_PCLUSTER|Z_EROFS_ADVISE_INLINE_PCLUSTER) and a PLAIN tail lcluster; z_erofs_read_folio/z_erofs_readahead pass them into z_erofs_map_blocks_fo when that compressed file's tail is read. No network protocol message carries those fields.\nAC:L - Setting both advise flags plus z_idata_size on a compressed inode with a PLAIN EOF lcluster makes z_erofs_map_blocks_fo assign Z_EROFS_COMPRESSION_INTERLACED despite EROFS_MAP_META; the following read of that tail reaches z_erofs_transform_plain every time, with no race or attacker-uncontrolled condition.\nPR:N - Crafting and supplying the interlaced+ztailpacking image requires no account on the target. erofs_fs_type has FS_REQUIRES_DEV and lacks FS_USERNS_MOUNT, so the attacker cannot self-mount in a userns; the CAP_SYS_ADMIN mount is the victim's action and is scored as UI:R.\nUI:R - A victim or automounter must mount the attacker-supplied EROFS image and read the compressed file so z_erofs_read_folio maps the ztailpacking pcluster. erofs_read_superblock and erofs_fill_inode do not call z_erofs_map_blocks_fo for that tail.\nS:U - The over-read in z_erofs_transform_plain and the memcpy_to_page into the file folio stay inside the host kernel; this does not cross a KVM/Xen, IOMMU, or sandbox authority.\nC:H - z_erofs_transform_plain kmaps the inline-metadata page and copies cur bytes from kin+pi into the output folio via memcpy_to_page. Unaligned ztailpacking pageofs_in (map->m_pa & ~PAGE_MASK) makes pi+cur run off that page, so up to a block of adjacent kernel memory becomes readable through the file.\nI:N - The write lands in rq->out[0] at pageofs_out for length cur=min(bs-(pageofs_out&(bs-1)),outputsize), which stays inside the first output folio. The defect is an input-side over-read, not an OOB write or corruption of kernel control data.\nA:H - The kmap_local_page over-read in the interlaced branch of z_erofs_transform_plain can fault when the next virtual page is unmapped (HIGHMEM kmap slots, debug_pagealloc, KASAN), oopsing the kernel, and reading the crafted tail again retriggers it."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/decompressor.c","fs/erofs/zmap.c"],"versions":[{"version":"fdffc091e6f94602558bba712b51bc16f79fd6d5","lessThan":"ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054","status":"affected","versionType":"git"},{"version":"fdffc091e6f94602558bba712b51bc16f79fd6d5","lessThan":"451027c642e752420e1a04237db9ce7b35cee595","status":"affected","versionType":"git"},{"version":"fdffc091e6f94602558bba712b51bc16f79fd6d5","lessThan":"862427ebb81d1f6abbf74d799790e1694b37b187","status":"affected","versionType":"git"},{"version":"7d6ef8277e44c22f894d54d26ddb36c22d60712d","status":"affected","versionType":"git"},{"version":"6.0.16","lessThan":"6.1","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/decompressor.c","fs/erofs/zmap.c"],"versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","status":"unaffected","versionType":"semver"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"7.3-rc1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"},{"url":"https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595"},{"url":"https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187"}],"title":"erofs: fix interlaced ztailpacking pclusters","x_generator":{"engine":"bippy-1.2.0"}}}}