GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46078 (GCVE-0-2026-46078)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:58 – Updated: 2026-08-05 12:29
VLAI
Title
erofs: fix the out-of-bounds nameoff handling for trailing dirents
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs. If a crafted EROFS has a trailing dirent with nameoff >= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block. nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1]. [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < a8ee527807f7d97e55ce2ef2906f7f34975eb1c7 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < aa16dca1b062355181ef215229eeac249d7c0d61 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < 80a23c6d1aba35be8746d74ac14e6ba5ae46da21 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < 222055e6b4063abd2d9e13c3d49bbd1724c50789 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < 48b27a955d22391c7f30169fa7b6b2e1977f1ce4 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < 8ebb951a284b7446e025afc7dc5e9516ef9a7214 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < 1d55445226c75ddd4e78b09b3e7d99109b28c366 (git)
Affected: 3aa8ec716e52c02360457fa018296629b4d0becf , < d18a3b5d337fa412a38e776e6b4b857a58836575 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.86 , ≤ 6.12.* (semver)
Unaffected: 6.18.27 , ≤ 6.18.* (semver)
Unaffected: 7.0.4 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8ee527807f7d97e55ce2ef2906f7f34975eb1c7",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "aa16dca1b062355181ef215229eeac249d7c0d61",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "80a23c6d1aba35be8746d74ac14e6ba5ae46da21",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "222055e6b4063abd2d9e13c3d49bbd1724c50789",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "48b27a955d22391c7f30169fa7b6b2e1977f1ce4",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "8ebb951a284b7446e025afc7dc5e9516ef9a7214",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "1d55445226c75ddd4e78b09b3e7d99109b28c366",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            },
            {
              "lessThan": "d18a3b5d337fa412a38e776e6b4b857a58836575",
              "status": "affected",
              "version": "3aa8ec716e52c02360457fa018296629b4d0becf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\n\nCurrently we already have boundary-checks for nameoffs, but the trailing\ndirents are special since the namelens are calculated with strnlen()\nwith unchecked nameoffs.\n\nIf a crafted EROFS has a trailing dirent with nameoff \u003e= maxsize,\nmaxsize - nameoff can underflow, causing strnlen() to read past the\ndirectory block.\n\nnameoff0 should also be verified to be a multiple of\n`sizeof(struct erofs_dirent)` as well [1].\n\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is triggered by parsing a maliciously crafted EROFS filesystem image during a directory read; the data is processed locally after the image is presented (file/loop/removable media), with no network reachability for the readdir path.\nAC:L - An attacker fully controls the on-disk `nameoff` field of the trailing dirent in the crafted image, so the unsigned underflow and resulting out-of-bounds `strnlen` are reproduced deterministically every time the directory is read.\nPR:N - Once the crafted image is mounted, triggering the bug requires only an ordinary directory listing (getdents/readdir), which needs no special privileges; this matches the sibling crafted-image EROFS CVE-2026-43166.\nUI:R - EROFS lacks FS_USERNS_MOUNT and requires CAP_SYS_ADMIN to mount, so a separate user/automounter must mount the attacker-supplied image before the vulnerable readdir path can execute.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed length drives an unbounded `strnlen` that reads kernel memory far past the directory-block buffer; per the OOB-read guidance this unbounded read is High.\nI:N - The defect is strictly a read (strnlen over adjacent memory); no out-of-bounds write, use-after-free, or type confusion occurs, so no data can be modified.\nA:H - Scanning up to ~4 GB past the buffer readily walks into unmapped memory, producing a kernel oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:31.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61"
        },
        {
          "url": "https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21"
        },
        {
          "url": "https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789"
        },
        {
          "url": "https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575"
        }
      ],
      "title": "erofs: fix the out-of-bounds nameoff handling for trailing dirents",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46078",
    "datePublished": "2026-05-27T12:58:11.916Z",
    "dateReserved": "2026-05-13T15:03:33.096Z",
    "dateUpdated": "2026-08-05T12:29:31.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46078",
      "date": "2026-09-16",
      "epss": "0.00131",
      "percentile": "0.03089"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:48:23.000Z",
      "cve": "CVE-2026-46078",
      "id": "msrc_CVE-2026-46078",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "erofs: fix the out-of-bounds nameoff handling for trailing dirents",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46078.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46078\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:29.143\",\"lastModified\":\"2026-06-24T17:20:32.217\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\\n\\nCurrently we already have boundary-checks for nameoffs, but the trailing\\ndirents are special since the namelens are calculated with strnlen()\\nwith unchecked nameoffs.\\n\\nIf a crafted EROFS has a trailing dirent with nameoff \u003e= maxsize,\\nmaxsize - nameoff can underflow, causing strnlen() to read past the\\ndirectory block.\\n\\nnameoff0 should also be verified to be a multiple of\\n`sizeof(struct erofs_dirent)` as well [1].\\n\\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/erofs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"a8ee527807f7d97e55ce2ef2906f7f34975eb1c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"aa16dca1b062355181ef215229eeac249d7c0d61\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"80a23c6d1aba35be8746d74ac14e6ba5ae46da21\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"222055e6b4063abd2d9e13c3d49bbd1724c50789\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"48b27a955d22391c7f30169fa7b6b2e1977f1ce4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"8ebb951a284b7446e025afc7dc5e9516ef9a7214\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"1d55445226c75ddd4e78b09b3e7d99109b28c366\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa8ec716e52c02360457fa018296629b4d0becf\",\"lessThan\":\"d18a3b5d337fa412a38e776e6b4b857a58836575\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/erofs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.86\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.27\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndExcluding\":\"5.10.259\",\"matchCriteriaId\":\"371269AD-0F41-4AA3-A04C-8560F4185F8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.210\",\"matchCriteriaId\":\"5E938CDF-D1C4-43D0-98DC-9E11B6B55801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.86\",\"matchCriteriaId\":\"55DA1C62-9991-451E-B8A8-E0004E00F789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.27\",\"matchCriteriaId\":\"A10AC84F-C058-47D5-85B4-E6E51A613B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T19:16:38+00:00",
      "cve": "CVE-2026-46078",
      "id": "CVE-2026-46078",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: erofs: fix the out-of-bounds nameoff handling for trailing dirents",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46078.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:56:56Z",
      "cve": "CVE-2026-46078",
      "id": "CVE-2026-46078",
      "initial_release_date": "2026-05-28T03:53:04Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "134",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "176",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46078",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46078.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.