CVE-2026-90161 (GCVE-0-2026-90161)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
erofs: fix interlaced ztailpacking pclusters
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054 (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < 451027c642e752420e1a04237db9ce7b35cee595 (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < 862427ebb81d1f6abbf74d799790e1694b37b187 (git)
Affected: 7d6ef8277e44c22f894d54d26ddb36c22d60712d (git)
Affected: 6.0.16 , < 6.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c",
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "451027c642e752420e1a04237db9ce7b35cee595",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "862427ebb81d1f6abbf74d799790e1694b37b187",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7d6ef8277e44c22f894d54d26ddb36c22d60712d",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c",
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced ztailpacking pclusters\n\nOn-disk sizes of interlaced pclusters should be block-aligned, and\nztailpacking interlaced pclusters should be invalid at all.\n\nCurrently, mkfs.erofs won\u0027t generate any interlaced pcluster with\nztailpacking enabled, so this doesn\u0027t affect any existing valid\nfilesystems.\n\nHowever, crafted images can contain invalid interlaced ztailpacking\npclusters, resulting in an out-of-bounds read from a kmap\u0027d page and\ncopying irrelevant kernel memory into userspace-visible page cache."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed bytes are on-disk in z_erofs_map_header.h_advise (Z_EROFS_ADVISE_INTERLACED_PCLUSTER|Z_EROFS_ADVISE_INLINE_PCLUSTER) and a PLAIN tail lcluster; z_erofs_read_folio/z_erofs_readahead pass them into z_erofs_map_blocks_fo when that compressed file\u0027s tail is read. No network protocol message carries those fields.\nAC:L - Setting both advise flags plus z_idata_size on a compressed inode with a PLAIN EOF lcluster makes z_erofs_map_blocks_fo assign Z_EROFS_COMPRESSION_INTERLACED despite EROFS_MAP_META; the following read of that tail reaches z_erofs_transform_plain every time, with no race or attacker-uncontrolled condition.\nPR:N - Crafting and supplying the interlaced+ztailpacking image requires no account on the target. erofs_fs_type has FS_REQUIRES_DEV and lacks FS_USERNS_MOUNT, so the attacker cannot self-mount in a userns; the CAP_SYS_ADMIN mount is the victim\u0027s action and is scored as UI:R.\nUI:R - A victim or automounter must mount the attacker-supplied EROFS image and read the compressed file so z_erofs_read_folio maps the ztailpacking pcluster. erofs_read_superblock and erofs_fill_inode do not call z_erofs_map_blocks_fo for that tail.\nS:U - The over-read in z_erofs_transform_plain and the memcpy_to_page into the file folio stay inside the host kernel; this does not cross a KVM/Xen, IOMMU, or sandbox authority.\nC:H - z_erofs_transform_plain kmaps the inline-metadata page and copies cur bytes from kin+pi into the output folio via memcpy_to_page. Unaligned ztailpacking pageofs_in (map-\u003em_pa \u0026 ~PAGE_MASK) makes pi+cur run off that page, so up to a block of adjacent kernel memory becomes readable through the file.\nI:N - The write lands in rq-\u003eout[0] at pageofs_out for length cur=min(bs-(pageofs_out\u0026(bs-1)),outputsize), which stays inside the first output folio. The defect is an input-side over-read, not an OOB write or corruption of kernel control data.\nA:H - The kmap_local_page over-read in the interlaced branch of z_erofs_transform_plain can fault when the next virtual page is unmapped (HIGHMEM kmap slots, debug_pagealloc, KASAN), oopsing the kernel, and reading the crafted tail again retriggers it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:29.404Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"
        },
        {
          "url": "https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595"
        },
        {
          "url": "https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187"
        }
      ],
      "title": "erofs: fix interlaced ztailpacking pclusters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90161",
    "datePublished": "2026-09-17T16:06:52.470Z",
    "dateReserved": "2026-09-11T19:38:34.790Z",
    "dateUpdated": "2026-09-18T17:53:29.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90161",
      "date": "2026-09-25",
      "epss": "0.00175",
      "percentile": "0.06137"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:45:05.000Z",
      "cve": "CVE-2026-90161",
      "id": "msrc_CVE-2026-90161",
      "initial_release_date": "2026-09-19T01:02:23.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "erofs: fix interlaced ztailpacking pclusters",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90161.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/decompressor.c",
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "451027c642e752420e1a04237db9ce7b35cee595",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "862427ebb81d1f6abbf74d799790e1694b37b187",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "7d6ef8277e44c22f894d54d26ddb36c22d60712d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "affected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/decompressor.c",
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.1"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced ztailpacking pclusters\n\nOn-disk sizes of interlaced pclusters should be block-aligned, and\nztailpacking interlaced pclusters should be invalid at all.\n\nCurrently, mkfs.erofs won\u0027t generate any interlaced pcluster with\nztailpacking enabled, so this doesn\u0027t affect any existing valid\nfilesystems.\n\nHowever, crafted images can contain invalid interlaced ztailpacking\npclusters, resulting in an out-of-bounds read from a kmap\u0027d page and\ncopying irrelevant kernel memory into userspace-visible page cache."
          }
        ],
        "id": "CVE-2026-90161",
        "lastModified": "2026-09-18T18:17:44.697",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:09.387",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:31:54Z",
      "cve": "CVE-2026-90161",
      "id": "CVE-2026-90161",
      "initial_release_date": "2026-09-18T00:20:34Z",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90161",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90161.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.