CVE-2026-46078: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46078 Overview

CVE-2026-46078 is an out-of-bounds read vulnerability in the Linux kernel's Enhanced Read-Only File System (EROFS). The flaw resides in the trailing dirent handling logic, where nameoff values are not validated before being used in strnlen() calculations. A crafted EROFS image containing a trailing dirent with nameoff >= maxsize triggers an integer underflow in maxsize - nameoff, causing strnlen() to read beyond the directory block boundary. The issue has been resolved upstream across multiple stable kernel branches.

Critical Impact
A maliciously crafted EROFS filesystem image can cause out-of-bounds memory reads in the Linux kernel, potentially leaking adjacent kernel memory or triggering denial of service when the image is mounted or traversed.

Affected Products

Linux kernel — EROFS filesystem implementation
Stable kernel branches receiving the backported fix commits
Distributions shipping vulnerable EROFS-enabled kernels

Discovery Timeline

2026-05-27 - CVE-2026-46078 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46078

Vulnerability Analysis

The vulnerability affects the EROFS directory parsing routines in the Linux kernel. EROFS stores directory entries as an array of struct erofs_dirent followed by a name table. Each dirent contains a nameoff field pointing to where its filename begins inside the directory block. The kernel performs boundary checks on most dirents, but the trailing dirent receives special treatment because its name length is computed by calling strnlen() against the remaining buffer.

The length argument passed to strnlen() is calculated as maxsize - nameoff. When an attacker constructs an EROFS image where the trailing dirent's nameoff is greater than or equal to maxsize, the subtraction underflows because both operands are unsigned. The result is an extremely large size_t value, which causes strnlen() to scan well past the end of the directory block and into adjacent memory.

Upstream maintainers also identified that nameoff0, the offset of the first dirent's name, must be validated as a multiple of sizeof(struct erofs_dirent). Without this check, malformed offsets can desynchronize parsing.

Root Cause

The root cause is missing input validation on attacker-controlled offsets in untrusted filesystem metadata. The trailing-dirent code path trusted nameoff without verifying it was strictly less than maxsize, enabling unsigned integer underflow [CWE-191] that produced an out-of-bounds read [CWE-125].

Attack Vector

Exploitation requires the victim system to mount or process a crafted EROFS image. This can occur through automatic mount of removable media, container image extraction, or any workflow that handles untrusted EROFS data. A local attacker with the ability to supply a filesystem image, or in some cases an unprivileged user able to mount user-namespace filesystems, can trigger the out-of-bounds read.

No verified public exploit code is available. Refer to the upstream commits for the technical fix: Kernel Git Commit 1d55445, Kernel Git Commit 222055e, Kernel Git Commit 48b27a9, Kernel Git Commit 8ebb951, and Kernel Git Commit d18a3b5.

Detection Methods for CVE-2026-46078

Indicators of Compromise

Kernel log entries referencing EROFS parsing errors, KASAN out-of-bounds read reports, or oopses originating in EROFS directory iteration functions.
Unexpected EROFS image files appearing in user-writable locations, container layers, or removable-media mount points.
Mount or auto-mount events for EROFS filesystems originating from non-administrator users or untrusted sources.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test and staging kernels to surface out-of-bounds reads in EROFS code paths during fuzzing or QA.
Audit kernel version inventory against the upstream stable trees containing the listed fix commits to identify hosts running vulnerable EROFS code.
Monitor dmesg and journald for erofs subsystem warnings, particularly entries mentioning dirent parsing, nameoff, or directory block validation failures.

Monitoring Recommendations

Log all mount syscalls involving the erofs filesystem type and alert on mounts initiated by non-root users or non-standard service accounts.
Track filesystem image artifacts entering the environment via container registries, package distribution channels, and removable storage.
Correlate kernel crash telemetry with recent EROFS mount activity to identify exploitation attempts.

How to Mitigate CVE-2026-46078

Immediate Actions Required

Apply the latest stable kernel update from your distribution vendor that incorporates the upstream EROFS fix commits referenced in the NVD entry.
Identify all systems with EROFS support compiled in or loadable as a module and prioritize patching for hosts that mount untrusted images.
Restrict the ability of unprivileged users to mount filesystems, particularly via user namespaces, until patches are deployed.

Patch Information

The fix adds strict validation that nameoff is strictly less than maxsize for trailing dirents and verifies that nameoff0 is a multiple of sizeof(struct erofs_dirent). The change has been merged and backported across multiple stable branches. Reference commits: 1d55445, 222055e, 48b27a9, 8ebb951, and d18a3b5 on git.kernel.org.

Workarounds

Unload the erofs kernel module on systems that do not require EROFS support using modprobe -r erofs and blacklist it to prevent automatic loading.
Disable automatic mounting of removable media and EROFS images for non-administrator users via udev and polkit policies.
Constrain container runtimes to validated, signed image sources to reduce exposure to crafted EROFS layers.

bash

# Blacklist the EROFS module on systems that do not need it
echo 'blacklist erofs' | sudo tee /etc/modprobe.d/blacklist-erofs.conf
sudo modprobe -r erofs 2>/dev/null || true

# Verify the running kernel version against your distribution's patched release
uname -r