Riskcovery

CVE-2026-98005

erofs: delimit inode_share cache key components

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: delimit inode_share cache key components

Previously, inode_share keys were encoded as follows:

fingerprint || domain_id

It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won't be parsed as part of a domain ID.

Change the key encoding as follows:

domain_id || '\0' || fingerprint

Since domain_id is a NUL-terminated string, this makes the in-memory key indices unambiguous.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e0bf7d1c074dc4252223ae897560345ccc24100d to before 16322a67336cfeea0af4b05206ef8d0e0eda55bbAffected
  • e0bf7d1c074dc4252223ae897560345ccc24100d to before 96bf9831fbf423b8104f7948cd8fe7007ecfb46cAffected
LinuxLinux
  • 7.0Affected
  • before 7.0Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.