HIGH
erofs LZ4Overlap Underflow
CVE-2026-45999
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
KernelScan AI5.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) properly: "outpages - inpages" wraps to a large value and the subsequent rq->out[] access reads past the decompressed_pages array. However, such crafted cases can correctly result in a corruption report in the normal LZ4 non-inplace path. Let's add an additional check to fix this for backporting. Reproducible image (base64-encoded gzipped blob): H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz 2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w ywAAAAAAAADwu14ATsEYtgBQAAA= $ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt $ dd if=/mnt/data of=/dev/null bs=4096 count=1
02KernelScan AI Analysis
Risk summary
A crafted EROFS filesystem image can trigger an integer underflow in the LZ4 decompression path, leading to out-of-bounds memory reads that may leak kernel memory or cause system crashes. This affects systems that mount untrusted EROFS images, typically requiring root privileges.
Vulnerability analysis
The vulnerability occurs in z_erofs_lz4_handle_overlap() when processing crafted EROFS images with illegal extents where outpages < inpages. The expression 'outpages - inpages' causes unsigned integer underflow, wrapping to a large value used as an array index in rq->out[]. This leads to out-of-bounds reads past the decompressed_pages array. The fix adds a bounds check 'rq->outpages >= rq->inpages' before the inplace decompression path. Attack surface is local-only, requiring the ability to mount filesystem images (typically root/CAP_SYS_ADMIN) and reading from the mounted filesystem.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.88 | f1374fa6e57f |
| 6.18 | 6.18.30 | c9ce18e6bb2c |
| 6.6 | 6.6.140 | 43a878639b90 |
| 7.0 | 7.0.4 | bbbbb3f0d786 |
| mainline | 7.1-rc1 | 21e161de2dc6 |