https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 01:41:07 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46078 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>erofs: fix the out-of-bounds nameoff handling for trailing dirents</p> <p>Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs.</p> <p>If a crafted EROFS has a trailing dirent with nameoff &gt;= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block.</p> <p>nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1].</p> <p>[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>erofs: fix the out-of-bounds nameoff handling for trailing dirents</p> <p>Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs.</p> <p>If a crafted EROFS has a trailing dirent with nameoff &gt;= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block.</p> <p>nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1].</p> <p>[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com</p> https://vulnerability.circl.lu/vuln/cve-2026-46078