CVE-2026-53015: Linux Kernel EROFS Data Truncation Flaw

CVE-2026-53015 Overview

CVE-2026-53015 affects the Enhanced Read-Only File System (EROFS) component of the Linux kernel. The vulnerability stems from improper integer typing where the logical cluster number (lcn) was declared as unsigned long or unsigned int. On 32-bit platforms, this type is only 32 bits wide, which causes the expression (lcn << lclusterbits) to be truncated at the 4 GiB boundary.

The fix unifies lcn as u64 consistently throughout the EROFS codebase to handle file offsets beyond 4 GiB on 32-bit systems. This is a kernel filesystem integrity issue affecting Linux systems mounting EROFS images on 32-bit architectures.

Critical Impact
Integer truncation in EROFS logical cluster handling on 32-bit Linux platforms can cause incorrect file data access for content beyond 4 GiB, potentially leading to filesystem corruption or data integrity failures.

Affected Products

Linux kernel EROFS subsystem on 32-bit platforms
Systems mounting EROFS images larger than 4 GiB on 32-bit architectures
Embedded and IoT Linux deployments using 32-bit kernels with EROFS

Discovery Timeline

2026-06-24 - CVE-2026-53015 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53015

Vulnerability Analysis

The vulnerability is a [numeric truncation error] in the EROFS filesystem driver. EROFS uses a logical cluster number (lcn) to address compressed or uncompressed blocks within a filesystem image. The driver computed byte offsets by shifting lcn left by lclusterbits positions.

When lcn was typed as unsigned long (32 bits on 32-bit platforms) or unsigned int, the shift operation (lcn << lclusterbits) overflowed the type width. Any logical address that would map beyond the 4 GiB boundary was silently truncated. The resulting offset wrapped around, pointing the driver at incorrect filesystem data.

This class of bug affects deterministic read paths inside EROFS metadata and extent lookup routines. The trigger does not require malicious input. A legitimately large EROFS image on a 32-bit host is sufficient to expose the truncation.

Root Cause

The root cause is inconsistent integer typing across the EROFS codebase. Some functions declared lcn as unsigned int and others as unsigned long. Neither width is sufficient on 32-bit architectures when the shifted value must represent byte offsets beyond 0xFFFFFFFF. The fix promotes lcn to u64 consistently across all callers.

Attack Vector

The attack vector is local and requires the host to mount or process an EROFS image whose addressable range exceeds 4 GiB on a 32-bit kernel. The vulnerability is not network-reachable. No public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Practical impact is limited to data integrity and filesystem reliability rather than direct code execution.

For implementation details, review the upstream fixes referenced in the kernel git commit 2d8c7edcb661, commit 4fc9b12e43a3, commit 582b0bf20115, and commit 858e4d98a86a.

Detection Methods for CVE-2026-53015

Indicators of Compromise

Kernel log entries from the erofs subsystem reporting read errors, corrupted extents, or unexpected EIO returns when accessing files beyond the 4 GiB boundary.
Inconsistent file contents or hash mismatches when reading large files from EROFS images on 32-bit kernels.
Application-level failures reading specific offsets in EROFS-backed content on 32-bit embedded devices.

Detection Strategies

Inventory 32-bit Linux systems and identify any that mount EROFS images, especially images larger than 4 GiB.
Compare running kernel versions against the patched commits referenced in the upstream kernel stable tree.
Validate integrity of EROFS-stored files by comparing checksums between 32-bit and 64-bit hosts mounting the same image.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on erofs warnings, mount failures, and I/O errors.
Track package and kernel version changes across the 32-bit device fleet to confirm patch deployment.
Monitor application-layer error rates on devices that read large EROFS-backed assets.

How to Mitigate CVE-2026-53015

Immediate Actions Required

Identify all 32-bit Linux systems in the environment that use EROFS, including embedded devices, IoT endpoints, and containers built on 32-bit base images.
Apply the upstream kernel patches that unify lcn as u64 across the EROFS codebase.
Where patching is not immediately feasible, restrict EROFS images on affected hosts to sizes below 4 GiB.

Patch Information

The fix is committed to the Linux kernel stable tree. Apply the upstream patches referenced as 2d8c7edcb661, 4fc9b12e43a3, 582b0bf20115, and 858e4d98a86a or update to a kernel release that includes them. Distribution maintainers should pull these commits into supported 32-bit kernel builds.

Workarounds

Migrate workloads from 32-bit to 64-bit kernels where feasible, since 64-bit builds are not affected by the truncation.
Constrain EROFS image sizes to below the 4 GiB threshold on unpatched 32-bit systems.
Use an alternative read-only filesystem on affected 32-bit hosts until the kernel patch is deployed.

bash

# Verify running kernel architecture and version
uname -m
uname -r

# Check if erofs module is loaded
lsmod | grep erofs

# Inspect kernel log for erofs-related messages
dmesg | grep -i erofs