GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89602 (GCVE-0-2026-89602)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:31
VLAI
Title
erofs: skip sufficiently large global buffers when resizing
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the guaranteed minimum size across the pool.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d6db47e571dcaecaeaafa8840d00ae849ae3907b , < 7267557ce98ccd07faaf3bc86382448950cc4ff6 (git)
Affected: d6db47e571dcaecaeaafa8840d00ae849ae3907b , < 7f4a89d4f0d6acaf4b756c31de48f2109a257b70 (git)
Affected: d6db47e571dcaecaeaafa8840d00ae849ae3907b , < a7d097cf01301c5da37927c8f26123d006f0fd8a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zutil.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7267557ce98ccd07faaf3bc86382448950cc4ff6",
              "status": "affected",
              "version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
              "versionType": "git"
            },
            {
              "lessThan": "7f4a89d4f0d6acaf4b756c31de48f2109a257b70",
              "status": "affected",
              "version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
              "versionType": "git"
            },
            {
              "lessThan": "a7d097cf01301c5da37927c8f26123d006f0fd8a",
              "status": "affected",
              "version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zutil.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: skip sufficiently large global buffers when resizing\n\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\ngrown. If a resize fails after some buffers were enlarged, a retry\nrevisits those enlarged buffers.\n\nRetrying the same size then returns -ENOMEM because alloc_pages_bulk()\nhas no pages to add and the unchanged return value is treated as a\nfailure. Retrying an intermediate size allocates a temporary pointer\narray smaller than gbuf-\u003enrpages and copies more existing pointers than\nthe array can hold.\n\nSkip buffers that already satisfy the request. Once all remaining\nbuffers have caught up, advancing z_erofs_gbuf_nrpages again describes\nthe guaranteed minimum size across the pool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - z_erofs_gbuf_growsize() runs only during a local EROFS mount (erofs_fc_get_tree \u2192 erofs_fc_fill_super \u2192 erofs_read_superblock \u2192 z_erofs_parse_cfgs \u2192 z_erofs_load_lz4_config) of a block, loop, or file-backed image. The LZ4 max_pclusterblks field is not parsed from a network protocol, so the vector is Local.\nAC:L - The attacker picks max_pclusterblks on two images (a large grow, then a strictly smaller size). After GFP_KERNEL alloc_pages_bulk()/vmap fails mid-loop, some per-CPU gbufs stay enlarged while z_erofs_gbuf_nrpages does not; the next intermediate mount then copies gbuf-\u003enrpages pointers into a smaller tmp_pages array with no race. A max-size image plus memory pressure makes that partial failure attacker-inducible.\nPR:N - Crafting and supplying the malicious EROFS images needs no account or capability on the target. erofs_fs_type lacks FS_USERNS_MOUNT, so the CAP_SYS_ADMIN mount is done by a victim, automounter, or container runtime (OCI/Nydus/Android image handling), matching other crafted-image EROFS CVEs.\nUI:R - mount_capable() requires CAP_SYS_ADMIN in the initial user namespace because EROFS is not FS_USERNS_MOUNT. A separate user, automounter, or container runtime must mount the attacker-supplied images before z_erofs_gbuf_growsize() runs.\nS:U - The heap overflow corrupts kmalloc objects inside the host kernel. That is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - The copy loop writes a nearly page-count-sized run of struct page * values past the kmalloc tmp_pages array (up to hundreds of pointers when max_pclusterblks is 256). That slab corruption can be turned into an arbitrary-read primitive against adjacent objects, so confidentiality impact is High.\nI:H - This is a kernel heap out-of-bounds write whose length is chosen by the two image sizes, smashing adjacent slab objects with kernel page pointers. Out-of-bounds writes are exploitable for arbitrary write and control-flow hijacking, so integrity impact is High.\nA:H - Overwriting adjacent kmalloc metadata and objects causes a kernel oops or panic. Independently, retrying the same size after a partial grow treats a full tmp_pages array as -ENOMEM and leaves the pool stuck, so later EROFS mounts fail until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:35.467Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7267557ce98ccd07faaf3bc86382448950cc4ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f4a89d4f0d6acaf4b756c31de48f2109a257b70"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7d097cf01301c5da37927c8f26123d006f0fd8a"
        }
      ],
      "title": "erofs: skip sufficiently large global buffers when resizing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89602",
    "datePublished": "2026-09-11T19:45:05.783Z",
    "dateReserved": "2026-09-11T19:38:34.732Z",
    "dateUpdated": "2026-09-13T06:31:35.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89602",
      "date": "2026-09-17",
      "epss": "0.00172",
      "percentile": "0.06889"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89602\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:45.117\",\"lastModified\":\"2026-09-13T07:17:25.637\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: skip sufficiently large global buffers when resizing\\n\\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\\ngrown. If a resize fails after some buffers were enlarged, a retry\\nrevisits those enlarged buffers.\\n\\nRetrying the same size then returns -ENOMEM because alloc_pages_bulk()\\nhas no pages to add and the unchanged return value is treated as a\\nfailure. Retrying an intermediate size allocates a temporary pointer\\narray smaller than gbuf-\u003enrpages and copies more existing pointers than\\nthe array can hold.\\n\\nSkip buffers that already satisfy the request. Once all remaining\\nbuffers have caught up, advancing z_erofs_gbuf_nrpages again describes\\nthe guaranteed minimum size across the pool.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/erofs/zutil.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d6db47e571dcaecaeaafa8840d00ae849ae3907b\",\"lessThan\":\"7267557ce98ccd07faaf3bc86382448950cc4ff6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6db47e571dcaecaeaafa8840d00ae849ae3907b\",\"lessThan\":\"7f4a89d4f0d6acaf4b756c31de48f2109a257b70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6db47e571dcaecaeaafa8840d00ae849ae3907b\",\"lessThan\":\"a7d097cf01301c5da37927c8f26123d006f0fd8a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/erofs/zutil.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7267557ce98ccd07faaf3bc86382448950cc4ff6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7f4a89d4f0d6acaf4b756c31de48f2109a257b70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a7d097cf01301c5da37927c8f26123d006f0fd8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:58:49+00:00",
      "cve": "CVE-2026-89602",
      "id": "CVE-2026-89602",
      "initial_release_date": "2026-09-11T19:45:05.783000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: erofs memory corruption during global buffer resizing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89602.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:58:16Z",
      "cve": "CVE-2026-89602",
      "id": "CVE-2026-89602",
      "initial_release_date": "2026-09-12T16:25:21Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89602",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89602.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.