CVE-2026-45999

erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

State: Published
Severity: 7.1 High
Published: May 27, 2026
Updated: Aug 5, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) properly: "outpages - inpages" wraps to a large value and the subsequent rq->out[] access reads past the decompressed_pages array.

However, such crafted cases can correctly result in a corruption report in the normal LZ4 non-inplace path.

Let's add an additional check to fix this for backporting.

Reproducible image (base64-encoded gzipped blob):

H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz 2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w ywAAAAAAAADwu14ATsEYtgBQAAA=

$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt $ dd if=/mnt/data of=/dev/null bs=4096 count=1

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	598162d050801e556750defff4ddab499e5d76ed to before 778acd52e9497806fbd2cea7f770c41d6850fc48Affected 598162d050801e556750defff4ddab499e5d76ed to before 118ff71ff09ebaf323a09af9e911517321a299f4Affected 598162d050801e556750defff4ddab499e5d76ed to before 43a878639b90e9721ffa5eb616a7e6d8454adef3Affected 598162d050801e556750defff4ddab499e5d76ed to before f1374fa6e57fd836623668d782ded9244cfd2938Affected 598162d050801e556750defff4ddab499e5d76ed to before c9ce18e6bb2c467ec85756dc7989b547b7584feeAffected 598162d050801e556750defff4ddab499e5d76ed to before bbbbb3f0d7864238a8da2a94cd6ec013fee06a2eAffected 598162d050801e556750defff4ddab499e5d76ed to before 21e161de2dc660b1bb70ef5b156ab8e6e1cca3abAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.88 through 6.12.Not affected 6.18.30 through 6.18.Not affected 7.0.4 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

598162d050801e556750defff4ddab499e5d76ed to before 778acd52e9497806fbd2cea7f770c41d6850fc48Affected
598162d050801e556750defff4ddab499e5d76ed to before 118ff71ff09ebaf323a09af9e911517321a299f4Affected
598162d050801e556750defff4ddab499e5d76ed to before 43a878639b90e9721ffa5eb616a7e6d8454adef3Affected
598162d050801e556750defff4ddab499e5d76ed to before f1374fa6e57fd836623668d782ded9244cfd2938Affected
598162d050801e556750defff4ddab499e5d76ed to before c9ce18e6bb2c467ec85756dc7989b547b7584feeAffected
598162d050801e556750defff4ddab499e5d76ed to before bbbbb3f0d7864238a8da2a94cd6ec013fee06a2eAffected
598162d050801e556750defff4ddab499e5d76ed to before 21e161de2dc660b1bb70ef5b156ab8e6e1cca3abAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.88 through 6.12.*Not affected
6.18.30 through 6.18.*Not affected
7.0.4 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.