High 7.1Published May 27, 2026

CVE-2026-45999erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

Updated under an hour ago (Oct 28, 2026, 12:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) properly: "outpages - inpages" wraps to a large value and the subsequent rq->out[] access reads past the decompressed_pages array. However, such crafted cases can correctly result in a corruption report in the normal LZ4 non-inplace path. Let's add an additional check to fix this for backporting. Reproducible image (base64-encoded gzipped blob): H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz 2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w ywAAAAAAAADwu14ATsEYtgBQAAA= $ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt $ dd if=/mnt/data of=/dev/null bs=4096 count=1

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	598162d050801e556750defff4ddab499e5d76ed builds before 778acd52e9497806fbd2cea7f770c41d6850fc48; 598162d050801e556750defff4ddab499e5d76ed builds before 118ff71ff09ebaf323a09af9e911517321a299f4; 598162d050801e556750defff4ddab499e5d76ed builds before 43a878639b90e9721ffa5eb616a7e6d8454adef3; from 598162d050801e556750defff4ddab499e5d76ed before f1374fa6e57fd836623668d782ded9244cfd2938; from 598162d050801e556750defff4ddab499e5d76ed before c9ce18e6bb2c467ec85756dc7989b547b7584fee; from 598162d050801e556750defff4ddab499e5d76ed before bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e; 598162d050801e556750defff4ddab499e5d76ed builds before 21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab	CNA record
linux linux_kernel linux:linux_kernel	from 5.13 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/778acd52e9497806fbd2cea7f770c41d6850fc48
https://git.kernel.org/stable/c/118ff71ff09ebaf323a09af9e911517321a299f4
https://git.kernel.org/stable/c/43a878639b90e9721ffa5eb616a7e6d8454adef3	patch
https://git.kernel.org/stable/c/f1374fa6e57fd836623668d782ded9244cfd2938	patch
https://git.kernel.org/stable/c/c9ce18e6bb2c467ec85756dc7989b547b7584fee	patch
https://git.kernel.org/stable/c/bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e	patch
https://git.kernel.org/stable/c/21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.