CVE-2026-43179: Linux Kernel Information Disclosure Flaw

CVE-2026-43179 Overview

CVE-2026-43179 is a Linux kernel vulnerability in the Enhanced Read-Only File System (EROFS) subsystem. The flaw involves incorrect early returns when the kernel processes crafted EROFS images that have metadata compression (metabox) enabled. These early exits skip required cleanup paths, producing folio reference leaks during image parsing.

The issue does not cause system crashes, kernel panics, or memory corruption. Impact is limited to resource leakage when invalid metabox-enabled images are mounted or accessed. Upstream maintainers resolved the issue across multiple stable branches via three commits in the kernel Git tree.

Critical Impact
Crafted EROFS images with metadata compression enabled trigger folio reference leaks in the kernel, leading to resource consumption without functional compromise.

Affected Products

Linux kernel versions containing the EROFS metabox metadata compression code path
Distributions shipping vulnerable EROFS implementations prior to the upstream fix
Systems mounting untrusted or user-supplied EROFS images

Discovery Timeline

2026-05-06 - CVE-2026-43179 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43179

Vulnerability Analysis

EROFS is a read-only filesystem used in Android and embedded Linux deployments. The metabox feature enables compression of filesystem metadata to reduce image footprint. When the kernel parses a malformed metabox-enabled image, validation logic returns early on certain error conditions without releasing folio references previously acquired during the parse.

A folio is a kernel memory abstraction representing one or more contiguous pages. Each folio acquired by filesystem code must be released through the matching folio_put() or equivalent path. The faulty early-return paths in the EROFS parser bypass these releases, leaving folios with elevated reference counts.

The outcome is a controlled resource leak rather than memory unsafety. Repeated mounting of crafted images can accumulate leaked references, but the bug does not enable code execution or privilege escalation.

Root Cause

The defect originates in EROFS error-handling logic that exits parsing routines before the cleanup section that drops folio references. Validation checks reject malformed metabox structures correctly but use direct return statements instead of branching to the unified cleanup label that calls the folio release primitives.

Attack Vector

An attacker must supply a crafted EROFS image to a vulnerable kernel. Typical scenarios include user-mounted disk images, container image layers, or Android update payloads. The attacker has no remote network vector and gains no execution capability. Exploitation requires the ability to trigger filesystem parsing of attacker-controlled image data.

The vulnerability is described in prose because verified proof-of-concept code is not published. See the upstream commits for the corrected control flow: Kernel Git Commit 041b5163, Kernel Git Commit 56e4a842, and Kernel Git Commit 643575d5.

Detection Methods for CVE-2026-43179

Indicators of Compromise

Unexpected mount or parse failures referencing the erofs subsystem in dmesg or the kernel ring buffer
Gradual growth in kernel memory usage correlated with EROFS mount activity from untrusted sources
Repeated attempts to mount EROFS images that fail validation while other system metrics remain normal

Detection Strategies

Audit kernel logs for erofs parser warnings and failed mount events tied to metabox-enabled images
Track folio and page cache statistics through /proc/meminfo and /proc/vmstat for anomalous unreclaimable memory growth
Inventory kernel versions across the fleet and flag hosts running EROFS code predating the three referenced stable commits

Monitoring Recommendations

Monitor mount syscalls invoking the EROFS filesystem type, especially from non-root or container contexts
Alert on processes that programmatically mount user-supplied disk images on production servers
Correlate EROFS mount events with subsequent memory pressure indicators to identify exploitation attempts

How to Mitigate CVE-2026-43179

Immediate Actions Required

Apply distribution kernel updates that include the upstream EROFS metabox fix once available
Restrict mounting of EROFS images to trusted administrators and validated image sources
Disable the EROFS kernel module on systems that do not require the filesystem

Patch Information

The fix is delivered through three upstream commits to the Linux stable tree: Kernel Git Commit 041b5163, Kernel Git Commit 56e4a842, and Kernel Git Commit 643575d5. The patches restructure the early-return paths to route through cleanup logic that properly releases folio references. Consult your distribution security tracker for the kernel package version that incorporates these commits.

Workarounds

Block loading of the erofs kernel module using modprobe blacklist configuration on systems that do not require it
Enforce that only signed or hash-validated EROFS images can be mounted in production environments
Limit CAP_SYS_ADMIN and unprivileged user namespace mount privileges that allow arbitrary filesystem mounts

bash

# Configuration example: blacklist the erofs module
echo "blacklist erofs" | sudo tee /etc/modprobe.d/blacklist-erofs.conf
sudo update-initramfs -u
# Verify the module is not loaded
lsmod | grep erofs