GHSA-37CQ-5FF4-FH64
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31In the Linux kernel, the following vulnerability has been resolved:
erofs: disable LZ4 rolling decompression for now
LZ4 rolling decompression [1] was introduced to reduce the memory footprint of temporary pages:
For many cases, it is needed for users to read small data within a compressed extent (pcluster), either due to random small read, or since uptodate folios (typically order-0) cannot be reused for decompression again since decompression algorithm refills already-uptodate folios.
Rolling decompression works because LZ4 is LZ77-based and only refers to the most recent 64 KiB of decompressed data, so in theory only a bounded rolling window of temporary pages is needed when decompressing.
It can save a lot of temporary memory, e.g. 601,960-byte data can be compressed into a 256k LZ4 compressed extent, which means it needs 146 extra pages per request in the worst case if rolling decompression is disabled.
However, the upstream LZ4 implementation is not under EROFS' control: For example, the literal copy memmove() may still copy long literals backward on x86 based on the address comparison even when the source and destination ranges do not overlap (IOWs, inline decompression doesn't need to be considered here). That breaks the rolling assumption and makes the optimization broken.
Disable it for now to make sure the data correctness first since EROFS is used everywhere now: The rolling window approach can be revived once we either ensure that the official LZ4 code always copies forward for non-overlapping ranges or maintain our own LZ4 implementation in EROFS.
The main impact is a higher runtime memory footprint; However, recent commit 0f6273ab4637 ("erofs: add a reserved buffer pool for lz4 decompression") helps mitigate this when enabled but it's still not perfect.
[1] https://www.usenix.org/conference/atc19/presentation/gao § 3.3 Decompression
{
"affected": [],
"aliases": [
"CVE-2026-98067"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:35Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: disable LZ4 rolling decompression for now\n\nLZ4 rolling decompression [1] was introduced to reduce the memory\nfootprint of temporary pages:\n\n For many cases, it is needed for users to read small data within\n a compressed extent (pcluster), either due to random small read, or\n since uptodate folios (typically order-0) cannot be reused for\n decompression again since decompression algorithm refills\n already-uptodate folios.\n\nRolling decompression works because LZ4 is LZ77-based and only refers\nto the most recent 64 KiB of decompressed data, so in theory only a\nbounded rolling window of temporary pages is needed when decompressing.\n\nIt can save a lot of temporary memory, e.g.\n 601,960-byte data can be compressed into a 256k LZ4 compressed extent,\n which means it needs 146 extra pages per request in the worst case if\n rolling decompression is disabled.\n\nHowever, the upstream LZ4 implementation is not under EROFS\u0027 control:\nFor example, the literal copy memmove() may still **copy long literals\nbackward** on x86 based on the address comparison even when the source\nand destination ranges do not overlap (IOWs, inline decompression\ndoesn\u0027t need to be considered here). That breaks the rolling assumption\nand makes the optimization broken.\n\nDisable it for now to make sure the data correctness first since EROFS\nis used everywhere now: The rolling window approach can be revived once\nwe either ensure that the official LZ4 code always copies forward for\nnon-overlapping ranges or maintain our own LZ4 implementation in EROFS.\n\nThe main impact is a higher runtime memory footprint; However, recent\ncommit 0f6273ab4637 (\"erofs: add a reserved buffer pool for lz4\ndecompression\") helps mitigate this when enabled but it\u0027s still not\nperfect.\n\n[1] https://www.usenix.org/conference/atc19/presentation/gao\n \u00a7 3.3 Decompression",
"id": "GHSA-37cq-5ff4-fh64",
"modified": "2026-09-25T12:31:35Z",
"published": "2026-09-25T12:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98067"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c9a2db4b9950b59c571258e4bae74c271f62dd66"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.