CVE-2025-39924

erofs: fix invalid algorithm for encoded extents

State: Published
Severity: 7.8 High
Published: Oct 1, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix invalid algorithm for encoded extents

The current algorithm sanity checks do not properly apply to new encoded extents.

Unify the algorithm check with Z_EROFS_COMPRESSION(_RUNTIME)_MAX and ensure consistency with sbi->available_compr_algs.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1d191b4ca51d73699cb127386b95ac152af2b930 to before db5d7abd379a8dcf030be8f52f99cadf7e397ba8Affected 1d191b4ca51d73699cb127386b95ac152af2b930 to before 131897c65e2b86cf14bec7379f44aa8fbb407526Affected
LinuxLinux	6.15Affected before 6.15Not affected 6.16.8 through 6.16.*Not affected 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.