Riskcovery

CVE-2024-26590

erofs: fix inconsistent per-file compression format

State
Published
Severity
5.5 Medium
Published
Feb 22, 2024
Updated
May 11, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix inconsistent per-file compression format

EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization.

However, syzkaller can generate inconsistent crafted images that use an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA algorithmtype even it's not set in `sbi->available_compr_algs`. This can lead to an unexpected "BUG: kernel NULL pointer dereference" if the corresponding decompressor isn't built-in.

Fix this by checking against `sbi->available_compr_algs` for each m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 8f89926290c4b3d31748d5089b27952243be0693 to before 47467e04816cb297905c0f09bc2d11ef865942d9Affected
  • 8f89926290c4b3d31748d5089b27952243be0693 to before 823ba1d2106019ddf195287ba53057aee33cf724Affected
  • 8f89926290c4b3d31748d5089b27952243be0693 to before eed24b816e50c6cd18cbee0ff0d7218c8fced199Affected
  • 8f89926290c4b3d31748d5089b27952243be0693 to before 118a8cf504d7dfa519562d000f423ee3ca75d2c4Affected
LinuxLinux
  • 5.16Affected
  • before 5.16Not affected
  • 6.1.80 through 6.1.*Not affected
  • 6.6.14 through 6.6.*Not affected
  • 6.7.2 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.