CVE-2026-64031: Linux Kernel Race Condition Vulnerability

CVE-2026-64031 Overview

CVE-2026-64031 is a race condition in the Linux kernel's Enhanced Read-Only File System (erofs) that affects the managed cache handling for unaligned compressed extents. The flaw resides in the z_erofs_fill_bio_vec() and z_erofs_bind_cache() code paths, where concurrent threads can operate on the same Z_EROFS_PREALLOCATED_FOLIO folio before its private field is cleared. This leads to filemap_add_folio() being called twice on the same folio for different pclusters. The condition only manifests when unaligned data compression is enabled, such as the -E48bit mkfs option with zstd.

Critical Impact
Local attackers with the ability to trigger reads on erofs images using unaligned compressed extents can corrupt kernel memory state, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Linux kernel builds with erofs support and unaligned compressed extents
Distributions shipping erofs images generated with -E48bit and zstd compression
Systems mounting untrusted or crafted erofs images

Discovery Timeline

2026-07-19 - CVE-2026-64031 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64031

Vulnerability Analysis

The erofs subsystem uses a managed page cache to share decompressed data across pclusters. After unaligned compressed extents were introduced, the sequence for attaching a preallocated folio to the cache became non-atomic with respect to concurrent lookups. Thread 1 executes filemap_add_folio() for a Z_EROFS_PREALLOCATED_FOLIO folio but has not yet called folio_attach_private(). Thread 2, running z_erofs_bind_cache() for a different pcluster, discovers the same folio because folio->private still carries the Z_EROFS_PREALLOCATED_FOLIO sentinel. Thread 2 then invokes filemap_add_folio() again on a folio that is already inserted, producing inconsistent cache state.

Root Cause

The root cause is a missing write ordering between cache insertion and private-field initialization. The folio becomes visible to other pclusters through the page cache before its private pointer transitions away from the preallocation sentinel. This is a race condition in the managed cache lifecycle for unaligned extents. The fix clears folio->private before making the folio visible in the managed cache, letting concurrent pclusters wait on the locked folio in the same manner used for other shared-folio paths introduced in commit 9e2f9d34dd12.

Attack Vector

Exploitation requires local access and low privileges. An attacker triggers reads against an erofs volume containing unaligned compressed extents, driving concurrent decompression across multiple pclusters that reference the same managed cache folio. Crafted erofs images can accelerate the race window. The vulnerability manifests in kernel context, allowing memory state corruption within the file system layer. See the upstream fix commits referenced below for the exact code changes.

Detection Methods for CVE-2026-64031

Indicators of Compromise

Kernel warnings or oops messages originating from z_erofs_fill_bio_vec or z_erofs_bind_cache
Unexpected filemap_add_folio failures logged against erofs mounts
Presence of erofs images built with -E48bit and zstd compression on systems running unpatched kernels

Detection Strategies

Inventory kernel versions across Linux fleets and compare against the fixed commits 038166f873c4, 425d32d6288d, and 649932fc3815
Audit mounted erofs volumes for the unaligned-extent feature flag using dump.erofs or equivalent tooling
Correlate kernel ring buffer messages with mount events for erofs to identify systems triggering the race

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central log platform and alert on erofs-related backtraces
Track mount and unmount events for erofs file systems, particularly on multi-tenant hosts
Monitor for user-supplied erofs images being mounted from writable locations such as /tmp or user home directories

How to Mitigate CVE-2026-64031

Immediate Actions Required

Apply the upstream stable kernel updates that include the erofs managed cache fix
Restrict mounting of erofs images to trusted administrators and disallow user-mountable erofs on shared systems
Rebuild affected erofs images without the -E48bit unaligned-extent feature if patching cannot be scheduled immediately

Patch Information

The fix has been merged upstream across the stable trees. Relevant commits include Kernel commit 038166f873c4, Kernel commit 425d32d6288d, and Kernel commit 649932fc3815. Deploy vendor kernel updates that incorporate these commits.

Workarounds

Avoid generating erofs images with the -E48bit option combined with zstd until kernels are patched
Disable automatic mounting of removable media containing erofs file systems
Constrain CAP_SYS_ADMIN and mount privileges through user namespace and seccomp policies to limit local exposure

bash

# Verify running kernel and erofs image features
uname -r
dump.erofs -s /path/to/image.erofs | grep -i feature