CVE-2026-45999

🗓️ 27 May 2026 12:55:53Reported by LinuxType

Erofs fixes unsigned underflow in z erofs overlap handling and adds a backporting check to prevent wraparound reads from crafted images.

Reporter	Title	Published	Views	Family All 16
CNNVD	Linux kernel 安全漏洞	27 May 202600:00	–	cnnvd
Cvelist	CVE-2026-45999 erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()	27 May 202612:55	–	cvelist
Debian CVE	CVE-2026-45999	27 May 202612:55	–	debiancve
EUVD	EUVD-2026-32295	27 May 202612:55	–	euvd
NVD	CVE-2026-45999	27 May 202614:17	–	nvd
OSV	BELL-CVE-2026-45999	28 May 202606:10	–	osv
OSV	DEBIAN-CVE-2026-45999	27 May 202614:17	–	osv
OSV	ECHO-37AA-FFCA-2F53	28 May 202604:10	–	osv
OSV	ROOT-OS-DEBIAN-12-CVE-2026-45999 CVE-2026-45999 in rootio-linux - Patched by Root	2 Jun 202604:12	–	osv
OSV	ROOT-OS-UBUNTU-2404-CVE-2026-45999 CVE-2026-45999 in rootio-linux - Patched by Root	3 Jun 202607:40	–	osv

Vulners

CNA

Node

linux linux_kernelRange5.13–6.6.140

linux linux_kernelRange6.7.0–6.12.88

linux linux_kernelRange6.13.0–6.18.30

linux linux_kernelRange6.19.0–7.0.4

linux linux_kernelRange7.1.0–7.1-rc1

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/erofs/decompressor.c"
    ],
    "versions": [
      {
        "version": "598162d050801e556750defff4ddab499e5d76ed",
        "lessThan": "43a878639b90e9721ffa5eb616a7e6d8454adef3",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "598162d050801e556750defff4ddab499e5d76ed",
        "lessThan": "f1374fa6e57fd836623668d782ded9244cfd2938",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "598162d050801e556750defff4ddab499e5d76ed",
        "lessThan": "c9ce18e6bb2c467ec85756dc7989b547b7584fee",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "598162d050801e556750defff4ddab499e5d76ed",
        "lessThan": "bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "598162d050801e556750defff4ddab499e5d76ed",
        "lessThan": "21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/erofs/decompressor.c"
    ],
    "versions": [
      {
        "version": "5.13",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.13",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.140",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.88",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.30",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.4",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1-rc1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/f1374fa6e57fd836623668d782ded9244cfd2938
git	www.git.kernel.org/stable/c/21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab
git	www.git.kernel.org/stable/c/c9ce18e6bb2c467ec85756dc7989b547b7584fee
git	www.git.kernel.org/stable/c/43a878639b90e9721ffa5eb616a7e6d8454adef3
git	www.git.kernel.org/stable/c/bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e

30 May 2026 11:17Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.1

EPSS0.00013