CVE-2026-90161 (GCVE-0-2026-90161)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-10-30 12:34
VLAI
Title
erofs: fix interlaced ztailpacking pclusters
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6637 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < b634286a8628155557a4f473a9dbab18bb439a7b (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < 795dca34a41545d377d19bc492b10bc789772410 (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < cd59f91cbc1e715cb5dc65773ee22123d70cb8f2 (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054 (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < 451027c642e752420e1a04237db9ce7b35cee595 (git)
Affected: fdffc091e6f94602558bba712b51bc16f79fd6d5 , < 862427ebb81d1f6abbf74d799790e1694b37b187 (git)
Affected: 7d6ef8277e44c22f894d54d26ddb36c22d60712d (git)
Affected: 6.0.16 , < 6.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.114 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c",
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b634286a8628155557a4f473a9dbab18bb439a7b",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "795dca34a41545d377d19bc492b10bc789772410",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "cd59f91cbc1e715cb5dc65773ee22123d70cb8f2",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "451027c642e752420e1a04237db9ce7b35cee595",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "lessThan": "862427ebb81d1f6abbf74d799790e1694b37b187",
              "status": "affected",
              "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7d6ef8277e44c22f894d54d26ddb36c22d60712d",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c",
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced ztailpacking pclusters\n\nOn-disk sizes of interlaced pclusters should be block-aligned, and\nztailpacking interlaced pclusters should be invalid at all.\n\nCurrently, mkfs.erofs won\u0027t generate any interlaced pcluster with\nztailpacking enabled, so this doesn\u0027t affect any existing valid\nfilesystems.\n\nHowever, crafted images can contain invalid interlaced ztailpacking\npclusters, resulting in an out-of-bounds read from a kmap\u0027d page and\ncopying irrelevant kernel memory into userspace-visible page cache."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed bytes are on-disk in z_erofs_map_header.h_advise (Z_EROFS_ADVISE_INTERLACED_PCLUSTER|Z_EROFS_ADVISE_INLINE_PCLUSTER) and a PLAIN tail lcluster; z_erofs_read_folio/z_erofs_readahead pass them into z_erofs_map_blocks_fo when that compressed file\u0027s tail is read. No network protocol message carries those fields.\nAC:L - Setting both advise flags plus z_idata_size on a compressed inode with a PLAIN EOF lcluster makes z_erofs_map_blocks_fo assign Z_EROFS_COMPRESSION_INTERLACED despite EROFS_MAP_META; the following read of that tail reaches z_erofs_transform_plain every time, with no race or attacker-uncontrolled condition.\nPR:N - Crafting and supplying the interlaced+ztailpacking image requires no account on the target. erofs_fs_type has FS_REQUIRES_DEV and lacks FS_USERNS_MOUNT, so the attacker cannot self-mount in a userns; the CAP_SYS_ADMIN mount is the victim\u0027s action and is scored as UI:R.\nUI:R - A victim or automounter must mount the attacker-supplied EROFS image and read the compressed file so z_erofs_read_folio maps the ztailpacking pcluster. erofs_read_superblock and erofs_fill_inode do not call z_erofs_map_blocks_fo for that tail.\nS:U - The over-read in z_erofs_transform_plain and the memcpy_to_page into the file folio stay inside the host kernel; this does not cross a KVM/Xen, IOMMU, or sandbox authority.\nC:H - z_erofs_transform_plain kmaps the inline-metadata page and copies cur bytes from kin+pi into the output folio via memcpy_to_page. Unaligned ztailpacking pageofs_in (map-\u003em_pa \u0026 ~PAGE_MASK) makes pi+cur run off that page, so up to a block of adjacent kernel memory becomes readable through the file.\nI:N - The write lands in rq-\u003eout[0] at pageofs_out for length cur=min(bs-(pageofs_out\u0026(bs-1)),outputsize), which stays inside the first output folio. The defect is an input-side over-read, not an OOB write or corruption of kernel control data.\nA:H - The kmap_local_page over-read in the interlaced branch of z_erofs_transform_plain can fault when the next virtual page is unmapped (HIGHMEM kmap slots, debug_pagealloc, KASAN), oopsing the kernel, and reading the crafted tail again retriggers it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:34:30.214Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b634286a8628155557a4f473a9dbab18bb439a7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/795dca34a41545d377d19bc492b10bc789772410"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd59f91cbc1e715cb5dc65773ee22123d70cb8f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"
        },
        {
          "url": "https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595"
        },
        {
          "url": "https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187"
        }
      ],
      "title": "erofs: fix interlaced ztailpacking pclusters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90161",
    "datePublished": "2026-09-17T16:06:52.470Z",
    "dateReserved": "2026-09-11T19:38:34.790Z",
    "dateUpdated": "2026-10-30T12:34:30.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90161",
      "date": "2026-11-04",
      "epss": "0.00176",
      "percentile": "0.07219"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-01T14:49:47.000Z",
      "cve": "CVE-2026-90161",
      "id": "msrc_CVE-2026-90161",
      "initial_release_date": "2026-09-19T01:02:23.000Z",
      "product_status:known_affected": "4",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "erofs: fix interlaced ztailpacking pclusters",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90161.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/decompressor.c",
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b634286a8628155557a4f473a9dbab18bb439a7b",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "795dca34a41545d377d19bc492b10bc789772410",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd59f91cbc1e715cb5dc65773ee22123d70cb8f2",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "451027c642e752420e1a04237db9ce7b35cee595",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "862427ebb81d1f6abbf74d799790e1694b37b187",
                    "status": "affected",
                    "version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "7d6ef8277e44c22f894d54d26ddb36c22d60712d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "affected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/decompressor.c",
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.1"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced ztailpacking pclusters\n\nOn-disk sizes of interlaced pclusters should be block-aligned, and\nztailpacking interlaced pclusters should be invalid at all.\n\nCurrently, mkfs.erofs won\u0027t generate any interlaced pcluster with\nztailpacking enabled, so this doesn\u0027t affect any existing valid\nfilesystems.\n\nHowever, crafted images can contain invalid interlaced ztailpacking\npclusters, resulting in an out-of-bounds read from a kmap\u0027d page and\ncopying irrelevant kernel memory into userspace-visible page cache."
          }
        ],
        "id": "CVE-2026-90161",
        "lastModified": "2026-10-30T13:20:44.337",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:09.387",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/795dca34a41545d377d19bc492b10bc789772410"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b634286a8628155557a4f473a9dbab18bb439a7b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd59f91cbc1e715cb5dc65773ee22123d70cb8f2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-30T13:52:35+00:00",
      "cve": "CVE-2026-90161",
      "id": "CVE-2026-90161",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "202",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: erofs: fix interlaced ztailpacking pclusters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90161.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-20T00:45:11Z",
      "cve": "CVE-2026-90161",
      "id": "CVE-2026-90161",
      "initial_release_date": "2026-09-18T00:20:34Z",
      "product_status:known_affected": "109",
      "product_status:known_not_affected": "239",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90161",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-90161.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.