Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size In fs/erofs/decompressorlzma.c, the module defines the global MicroLZMA stream pool via numpossiblecpus when the lzmastreams module parameter is unset; subsequently, zerofsloadlzmaconfig...

CVE-2026-80899

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System fscache backend. This component, which provided image lazy pulling functionality, contained implementation issues that led to its deprecation and subsequent removal. While the specific impact of these issues is not...

USN-8959-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Multiple devices driver; - ARM64 architecture; - EROFS file system; -...

USN-8960-1 linux-oem-7.0 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Multiple devices driver; - ARM64 architecture; - EROFS file system; -...

USN-8960-1: Linux kernel (OEM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Multiple devices driver; - ARM64 architecture; - EROFS file system; -...

Linux kernel DoS

The vulnerability in the fs/erofs/zmap.c component of the Linux kernel system is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142740)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142740 advisory. In the Linux kernel, the following vulnerability has been resolved: erofs: stop parsing non-compact HEAD index if clusterofs is invalid Syzbot generated a crafted...

CVE-2026-80892

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. On systems with a high number of processing units, mounting a specially crafted EROFS image can cause the kernel to allocate an excessive amount of memory for LZMA decompression streams. This uncontrolled memor...

CVE-2026-97605

A flaw was found in the Linux kernel. When resizing the decompression stream pool in the Enhanced Read-Only File System EROFS encounters a memory allocation failure, an uninitialized stream is improperly retained in the active pool. A local user accessing or decompressing an affected filesystem c...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed in two specially crafted images. The root cause is that clusterofs can be larger than lclustersize for !NONHEAD...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: add GFPNOIO in the bio completion if needed The bio completion path in the process context e.g., dm-verity will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencie...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: unify lcn as u64 for 32-bit platforms As reported by sashiko 1, lcn was defined as unsigned long or sometimes unsigned int, which occupies only 32 bits on 32-bit platforms. This results in lcn lclusterbits being truncated ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: Properly handle overlapped pclusters from crafted images SyZBot reported a task hang issue caused by a deadlock condition wherein it waits for the folio lock of a cached folio that will be used for cache I/O operations. Up...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi-syncdecompress zerofsdecompresskickoff can race with filesystem unmount, causing a use-after-free on sbi-syncdecompress. When I/O completes, zerofsendio calls zerofsdecompresskickoff to queue...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. Otherwise, zerofsdecompresspcluster may assume they are alread...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary checks for nameoffs; however, trailing dirents are special because the nameoff values are calculated using strnlen without any...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in zerofslz4handleoverlap Some crafted images can have illegal !partialdecoding && mllen out access reads past the decompressedpages array. However, such crafted cases can correctly result in a...

OESA-2026-4358 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: erofs: The issue of generating a order = MAXORDER warning due to an intentionally crafted negative isize has been fixed. As reported by syzbot 1, the root cause is that the isize field is a signed type, and a negative isize value...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stress-testing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found that some short-lived temporary pages were n...