Medium 5.5Published Jun 9, 2026

CVE-2026-46329erofs: handle end of filesystem properly for file-backed mounts

Updated under an hour ago (Oct 27, 2026, 1:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: erofs: handle end of filesystem properly for file-backed mounts I/O requests beyond the end of the filesystem should be zeroed out, similar to loopback devices and that is what we expect.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before 8d582d65d20bb4796db01b19e86909ad68cb337b; from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before e49abde0ffc382a967b24f326d1614ac3bb06a94; from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before fe4039034dcdf584afbf763787909e28e92a4927; from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc	CNA record
linux linux_kernel linux:linux_kernel	from 6.12 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/8d582d65d20bb4796db01b19e86909ad68cb337b	patch
https://git.kernel.org/stable/c/e49abde0ffc382a967b24f326d1614ac3bb06a94	patch
https://git.kernel.org/stable/c/fe4039034dcdf584afbf763787909e28e92a4927	patch
https://git.kernel.org/stable/c/bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.