CVE-2026-45999 Overview
CVE-2026-45999 is an unsigned integer underflow vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) LZ4 decompression path. The flaw resides in the z_erofs_lz4_handle_overlap() function. A crafted EROFS image can declare illegal extents where m_llen < m_plen without partial decoding set. This condition incorrectly triggers the LZ4 inplace decompression path, which cannot handle the outpages < inpages case. The expression outpages - inpages wraps to a large unsigned value, causing subsequent rq->out[] accesses to read past the decompressed_pages array.
Critical Impact
A malicious EROFS image, when mounted and read, triggers out-of-bounds memory reads in kernel space, leading to denial of service or potential information disclosure.
Affected Products
- Linux kernel (mainline) prior to the commit series fixing z_erofs_lz4_handle_overlap()
- Linux stable branches receiving backports 21e161de, 43a87863, bbbbb3f0, c9ce18e6, and f1374fa6
- Distributions shipping vulnerable EROFS LZ4 decompression code
Discovery Timeline
- 2026-05-27 - CVE-2026-45999 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45999
Vulnerability Analysis
The vulnerability is an unsigned integer underflow [CWE-191] in the LZ4 inplace decompression routine of EROFS. EROFS supports inplace decompression to reduce memory pressure by reusing the input compressed pages as output buffer slots when the output footprint fits within the input pages. The z_erofs_lz4_handle_overlap() helper assumes outpages >= inpages because legitimate extents satisfy m_llen >= m_plen whenever partial decoding is not requested.
A crafted image can violate this invariant by declaring an extent with !partial_decoding && m_llen < m_plen. When this image is mounted and the affected extent is read, the inplace path is incorrectly selected. The subtraction outpages - inpages underflows in unsigned arithmetic and produces a large value used as a loop bound or index. The kernel then dereferences rq->out[] past the end of the decompressed_pages array, performing out-of-bounds reads in kernel memory.
Root Cause
The root cause is missing validation of extent metadata before selecting the inplace decompression path. The code path trusts that m_llen >= m_plen for non-partial extents and performs unsigned subtraction without bounds checking. Crafted on-disk metadata bypasses the implicit assumption.
Attack Vector
An attacker supplies a malicious EROFS image and induces a privileged user or automated mount process to mount it. Reading any byte from a file backed by the corrupted extent triggers the underflow. The reproducer in the upstream commit demonstrates the issue with a small base64-encoded EROFS blob mounted with cache_strategy=disabled, followed by dd if=/mnt/data of=/dev/null bs=4096 count=1. Local users with permission to mount arbitrary filesystems, or systems that auto-mount removable media, are the primary exposure surface.
No verified public exploit code is available beyond the reproducer image embedded in the kernel commit message. The vulnerability is described in prose without synthetic exploitation code.
Detection Methods for CVE-2026-45999
Indicators of Compromise
- Kernel oops, panic, or KASAN out-of-bounds read reports referencing z_erofs_lz4_handle_overlap or z_erofs_lz4_decompress in the stack trace
- Unexpected EROFS mount activity involving images from untrusted sources or removable media
- dmesg entries showing EROFS corruption reports correlated with crashes shortly after mount
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test and pre-production kernels to catch the out-of-bounds read at the moment of exploitation
- Audit mount(2) and fsopen(2) syscalls for erofs filesystem type, especially when the source is a loopback image in a user-writable path
- Correlate filesystem mount events with subsequent kernel warnings or process crashes reading from the new mount point
Monitoring Recommendations
- Monitor auditd rules covering the mount syscall with filesystem type erofs and alert on mounts originating from non-root users or container runtimes
- Collect dmesg and journalctl -k output centrally and alert on EROFS-prefixed errors or KASAN reports
- Track kernel package versions across the fleet to identify hosts still running pre-patch builds
How to Mitigate CVE-2026-45999
Immediate Actions Required
- Apply the upstream kernel patches 21e161de, 43a87863, bbbbb3f0, c9ce18e6, or f1374fa6 matching your stable branch
- Update to a distribution kernel that incorporates the fix to z_erofs_lz4_handle_overlap()
- Restrict the ability to mount arbitrary EROFS images to trusted administrators only
Patch Information
The fix adds an explicit check to reject extents where !partial_decoding && m_llen < m_plen before entering the inplace decompression path. Crafted images now produce a corruption report through the normal non-inplace path instead of underflowing. The patches are available from the upstream stable tree: Kernel Patch 21e161de, Kernel Patch 43a87863, Kernel Patch bbbbb3f0, Kernel Patch c9ce18e6, and Kernel Patch f1374fa6.
Workarounds
- Disable or blacklist the erofs kernel module on systems that do not require it
- Block unprivileged users from mounting filesystems by removing SYS_ADMIN capability in containers and tightening udev auto-mount policies
- Reject untrusted EROFS images at ingestion boundaries such as artifact registries and removable media scanners
# Configuration example: blacklist the erofs module if unused
echo 'blacklist erofs' | sudo tee /etc/modprobe.d/blacklist-erofs.conf
sudo depmod -a
# Verify the module is not loaded
lsmod | grep -i erofs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
