CVE-2026-45943: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45943 Overview

CVE-2026-45943 is a NULL pointer dereference vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation. The flaw resides in the ztailpacking pcluster handling logic, where compressed folios are added to I/O chains before being validated. When z_erofs_decompress_pcluster() later processes these pclusters, it assumes the folios are valid and dereferences a NULL pointer, triggering a kernel crash.

The issue manifests when read_mapping_folio() fails to retrieve inline data, such as when a fatal signal interrupts the read operation. The result is a kernel oops during decompression queue processing.

Critical Impact
Local users reading from EROFS-mounted volumes with ztailpacking pclusters can trigger a kernel NULL pointer dereference, leading to denial of service.

Affected Products

Linux kernel versions containing the EROFS ztailpacking pcluster implementation
Systems mounting EROFS images that use ztailpacking compression layout
Container and overlay filesystem stacks (ovl_read_iter) backed by EROFS

Discovery Timeline

2026-05-27 - CVE-2026-45943 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45943

Vulnerability Analysis

The vulnerability exists in the EROFS decompression path for ztailpacking pclusters. EROFS uses ztailpacking to store the tail of compressed data inline with metadata, reducing wasted space. The kernel reads this inline data via read_mapping_folio() during z_erofs_pcluster_begin().

The original code added pclusters to the I/O chain before confirming that the inline data folios were successfully retrieved and marked valid. When read_mapping_folio() returned an error such as -EINTR (-4) due to a fatal signal, the pcluster remained linked to the I/O chain with invalid folio state. Subsequent processing in z_erofs_decompress_queue() then dereferenced a NULL pointer at virtual address 0x8, as shown in the captured call trace.

Root Cause

The root cause is an ordering defect: compressed folios for ztailpacking pclusters were not guaranteed to be valid before being attached to I/O chains. The downstream decompression code in z_erofs_decompress_pcluster() operated on the assumption that any pcluster reaching it had valid folios. This violated the implicit contract between producer and consumer in the decompression pipeline.

The condition is hard to reproduce because the inline data normally resides in the same block as the compressed index tail, which is typically already cached. The race window opens primarily when signal delivery interrupts the folio read.

Attack Vector

An attacker with local access who can trigger reads on EROFS-backed files and deliver fatal signals to the reading process can provoke the NULL pointer dereference. The classification falls under [CWE-476] Null Pointer Dereference and kernel denial of service.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream kernel commit log. See the Kernel Git Commit Fix for the patch source.

Detection Methods for CVE-2026-45943

Indicators of Compromise

Kernel log entries containing erofs: ... z_erofs_pcluster_begin: failed to get inline data -4
Kernel oops messages referencing z_erofs_decompress_queue in the call trace
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 panics on EROFS reads

Detection Strategies

Monitor dmesg and journalctl -k for EROFS error strings and decompression queue crashes
Correlate kernel oops events with processes performing reads on EROFS or overlayfs mounts backed by EROFS
Track unexpected reboots or kernel panics on hosts running container runtimes that use EROFS images

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized SIEM or data lake for crash signature analysis
Alert on repeated z_erofs_pcluster_begin failures originating from the same workload or container
Inventory kernel versions across the fleet to identify hosts running unpatched EROFS code

How to Mitigate CVE-2026-45943

Immediate Actions Required

Apply the upstream Linux kernel patches that read inline data before allocating and adding pclusters to I/O chains
Update to a stable kernel release that includes commits 5de1aa0b, 92088bd9, ad07ea06, or c134a40f
Reboot affected hosts after kernel package upgrade to load the patched image

Patch Information

The fix reorders the pcluster begin sequence so that inline data is read before pclusters are linked into I/O chains. Refer to the upstream commits: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Patch, and Kernel Git Commit Change.

Workarounds

Avoid using EROFS images that rely on ztailpacking compression layout until patched kernels are deployed
Where feasible, switch container image formats or backing filesystems to non-EROFS alternatives on unpatched hosts
Restrict the ability of untrusted local users to deliver fatal signals to processes reading EROFS-backed files

bash

# Verify kernel version and check for EROFS ztailpacking usage
uname -r
grep -i erofs /proc/filesystems
mount | grep erofs
# Inspect kernel logs for indicators
dmesg | grep -iE 'erofs|z_erofs_pcluster_begin'