CVE-2026-89602 (GCVE-0-2026-89602)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-10-19 08:49
VLAI
EPSS
VEX
Title
erofs: skip sufficiently large global buffers when resizing
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: skip sufficiently large global buffers when resizing
z_erofs_gbuf_nrpages is advanced only after every global buffer has been
grown. If a resize fails after some buffers were enlarged, a retry
revisits those enlarged buffers.
Retrying the same size then returns -ENOMEM because alloc_pages_bulk()
has no pages to add and the unchanged return value is treated as a
failure. Retrying an intermediate size allocates a temporary pointer
array smaller than gbuf->nrpages and copies more existing pointers than
the array can hold.
Skip buffers that already satisfy the request. Once all remaining
buffers have caught up, advancing z_erofs_gbuf_nrpages again describes
the guaranteed minimum size across the pool.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
d6db47e571dcaecaeaafa8840d00ae849ae3907b , < 3fbdd15d5830f52661eb78be95058d101cb0c2cb
(git)
Affected: d6db47e571dcaecaeaafa8840d00ae849ae3907b , < 7267557ce98ccd07faaf3bc86382448950cc4ff6 (git) Affected: d6db47e571dcaecaeaafa8840d00ae849ae3907b , < 7f4a89d4f0d6acaf4b756c31de48f2109a257b70 (git) Affected: d6db47e571dcaecaeaafa8840d00ae849ae3907b , < a7d097cf01301c5da37927c8f26123d006f0fd8a (git) |
guessed | |
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/zutil.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3fbdd15d5830f52661eb78be95058d101cb0c2cb",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
},
{
"lessThan": "7267557ce98ccd07faaf3bc86382448950cc4ff6",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
},
{
"lessThan": "7f4a89d4f0d6acaf4b756c31de48f2109a257b70",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
},
{
"lessThan": "a7d097cf01301c5da37927c8f26123d006f0fd8a",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/zutil.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: skip sufficiently large global buffers when resizing\n\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\ngrown. If a resize fails after some buffers were enlarged, a retry\nrevisits those enlarged buffers.\n\nRetrying the same size then returns -ENOMEM because alloc_pages_bulk()\nhas no pages to add and the unchanged return value is treated as a\nfailure. Retrying an intermediate size allocates a temporary pointer\narray smaller than gbuf-\u003enrpages and copies more existing pointers than\nthe array can hold.\n\nSkip buffers that already satisfy the request. Once all remaining\nbuffers have caught up, advancing z_erofs_gbuf_nrpages again describes\nthe guaranteed minimum size across the pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - z_erofs_gbuf_growsize() runs only during a local EROFS mount (erofs_fc_get_tree \u2192 erofs_fc_fill_super \u2192 erofs_read_superblock \u2192 z_erofs_parse_cfgs \u2192 z_erofs_load_lz4_config) of a block, loop, or file-backed image. The LZ4 max_pclusterblks field is not parsed from a network protocol, so the vector is Local.\nAC:L - The attacker picks max_pclusterblks on two images (a large grow, then a strictly smaller size). After GFP_KERNEL alloc_pages_bulk()/vmap fails mid-loop, some per-CPU gbufs stay enlarged while z_erofs_gbuf_nrpages does not; the next intermediate mount then copies gbuf-\u003enrpages pointers into a smaller tmp_pages array with no race. A max-size image plus memory pressure makes that partial failure attacker-inducible.\nPR:N - Crafting and supplying the malicious EROFS images needs no account or capability on the target. erofs_fs_type lacks FS_USERNS_MOUNT, so the CAP_SYS_ADMIN mount is done by a victim, automounter, or container runtime (OCI/Nydus/Android image handling), matching other crafted-image EROFS CVEs.\nUI:R - mount_capable() requires CAP_SYS_ADMIN in the initial user namespace because EROFS is not FS_USERNS_MOUNT. A separate user, automounter, or container runtime must mount the attacker-supplied images before z_erofs_gbuf_growsize() runs.\nS:U - The heap overflow corrupts kmalloc objects inside the host kernel. That is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - The copy loop writes a nearly page-count-sized run of struct page * values past the kmalloc tmp_pages array (up to hundreds of pointers when max_pclusterblks is 256). That slab corruption can be turned into an arbitrary-read primitive against adjacent objects, so confidentiality impact is High.\nI:H - This is a kernel heap out-of-bounds write whose length is chosen by the two image sizes, smashing adjacent slab objects with kernel page pointers. Out-of-bounds writes are exploitable for arbitrary write and control-flow hijacking, so integrity impact is High.\nA:H - Overwriting adjacent kmalloc metadata and objects causes a kernel oops or panic. Independently, retrying the same size after a partial grow treats a full tmp_pages array as -ENOMEM and leaves the pool stuck, so later EROFS mounts fail until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:49:34.524Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3fbdd15d5830f52661eb78be95058d101cb0c2cb"
},
{
"url": "https://git.kernel.org/stable/c/7267557ce98ccd07faaf3bc86382448950cc4ff6"
},
{
"url": "https://git.kernel.org/stable/c/7f4a89d4f0d6acaf4b756c31de48f2109a257b70"
},
{
"url": "https://git.kernel.org/stable/c/a7d097cf01301c5da37927c8f26123d006f0fd8a"
}
],
"title": "erofs: skip sufficiently large global buffers when resizing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89602",
"datePublished": "2026-09-11T19:45:05.783Z",
"dateReserved": "2026-09-11T19:38:34.732Z",
"dateUpdated": "2026-10-19T08:49:34.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-89602",
"date": "2026-11-11",
"epss": "0.00176",
"percentile": "0.072"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/zutil.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3fbdd15d5830f52661eb78be95058d101cb0c2cb",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
},
{
"lessThan": "7267557ce98ccd07faaf3bc86382448950cc4ff6",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
},
{
"lessThan": "7f4a89d4f0d6acaf4b756c31de48f2109a257b70",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
},
{
"lessThan": "a7d097cf01301c5da37927c8f26123d006f0fd8a",
"status": "affected",
"version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/zutil.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: skip sufficiently large global buffers when resizing\n\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\ngrown. If a resize fails after some buffers were enlarged, a retry\nrevisits those enlarged buffers.\n\nRetrying the same size then returns -ENOMEM because alloc_pages_bulk()\nhas no pages to add and the unchanged return value is treated as a\nfailure. Retrying an intermediate size allocates a temporary pointer\narray smaller than gbuf-\u003enrpages and copies more existing pointers than\nthe array can hold.\n\nSkip buffers that already satisfy the request. Once all remaining\nbuffers have caught up, advancing z_erofs_gbuf_nrpages again describes\nthe guaranteed minimum size across the pool."
}
],
"id": "CVE-2026-89602",
"lastModified": "2026-10-19T09:17:56.743",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-11T20:19:45.117",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3fbdd15d5830f52661eb78be95058d101cb0c2cb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/7267557ce98ccd07faaf3bc86382448950cc4ff6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/7f4a89d4f0d6acaf4b756c31de48f2109a257b70"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a7d097cf01301c5da37927c8f26123d006f0fd8a"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:19:03+00:00",
"cve": "CVE-2026-89602",
"id": "CVE-2026-89602",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "2",
"product_status:known_not_affected": "201",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: erofs: skip sufficiently large global buffers when resizing",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89602.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.