CVE-2026-53015

erofs: unify lcn as u64 for 32-bit platforms

State: Published
Severity: Not scored
Published: Jun 24, 2026
Updated: Oct 30, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: unify lcn as u64 for 32-bit platforms

As sashiko reported [1], `lcn` was typed as `unsigned long` (or `unsigned int` sometimes), which is only 32 bits wide on 32-bit platforms, which causes `(lcn << lclusterbits)` to be truncated at 4 GiB.

In order to consolidate the logic, just use `u64` consistently around the codebase.

[1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	152a333a589560bee002e4c96761f1b560a5793c to before d142250132454bf86cba87018fb2d29c482dacd6Affected 152a333a589560bee002e4c96761f1b560a5793c to before 18f9f3ddbf2ed6d245a4c6f91c51f7248f8a982cAffected 152a333a589560bee002e4c96761f1b560a5793c to before 4fc9b12e43a3f19a01a8fb61f7961be79de20253Affected 152a333a589560bee002e4c96761f1b560a5793c to before 858e4d98a86adf34584767388deb6c9b217f70c5Affected 152a333a589560bee002e4c96761f1b560a5793c to before 582b0bf201157632cb5474c885989a6ebda46521Affected 152a333a589560bee002e4c96761f1b560a5793c to before 2d8c7edcb661812249469f4a5b62e9339118846fAffected
LinuxLinux	5.3Affected before 5.3Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

152a333a589560bee002e4c96761f1b560a5793c to before d142250132454bf86cba87018fb2d29c482dacd6Affected
152a333a589560bee002e4c96761f1b560a5793c to before 18f9f3ddbf2ed6d245a4c6f91c51f7248f8a982cAffected
152a333a589560bee002e4c96761f1b560a5793c to before 4fc9b12e43a3f19a01a8fb61f7961be79de20253Affected
152a333a589560bee002e4c96761f1b560a5793c to before 858e4d98a86adf34584767388deb6c9b217f70c5Affected
152a333a589560bee002e4c96761f1b560a5793c to before 582b0bf201157632cb5474c885989a6ebda46521Affected
152a333a589560bee002e4c96761f1b560a5793c to before 2d8c7edcb661812249469f4a5b62e9339118846fAffected

LinuxLinux

5.3Affected
before 5.3Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.