CVE-2026-80892: Linux Kernel LZMA Stream Pool Memory Issue

CVE-2026-80892 Overview

CVE-2026-80892 is a resource exhaustion vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) LZMA decompressor. The flaw resides in fs/erofs/decompressor_lzma.c, which sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset. The z_erofs_load_lzma_config() function then preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB in size. On high-CPU systems, mounting a small EROFS image can pin hundreds of megabytes of vmalloc-backed decoder state until the erofs module is unloaded.

Critical Impact
A mounted EROFS image can pin up to 8 MiB of vmalloc memory per LZMA stream, potentially reaching 128 MiB or more on systems with 16 or more CPUs.

Affected Products

Linux Kernel EROFS filesystem with LZMA compression support
Systems built with CONFIG_EROFS_FS_ZIP_LZMA
High-CPU-count Linux hosts mounting untrusted EROFS images

Discovery Timeline

2026-09-04 - CVE-2026-80892 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80892

Vulnerability Analysis

The vulnerability stems from unbounded default sizing of the LZMA decoder stream pool in the EROFS filesystem. When the lzma_streams module parameter is not explicitly set, the kernel allocates one stream per possible CPU. Each stream is paired with an image-supplied dictionary that can reach 8 MiB. The resulting worst-case memory footprint scales linearly with CPU count, allowing a small EROFS image to pin substantial vmalloc memory regardless of the image's actual size or workload.

The fix introduces a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS build option with a default of 16. This caps the worst-case default preallocation at 128 MiB on systems with 16 or more CPUs while preserving the per-image dictionary limit. Administrators who explicitly set lzma_streams retain full control over pool sizing.

Root Cause

The root cause is a design flaw in resource sizing: the LZMA stream pool defaults to num_possible_cpus() without any upper bound. Combined with the 8 MiB per-dictionary allowance, the module-global allocation grows proportionally to hardware topology rather than actual decompression demand. Memory persists for the lifetime of the erofs module.

Attack Vector

An attacker or unprivileged actor capable of causing the system to mount a crafted EROFS image can trigger the worst-case allocation. Because the dictionary size is image-supplied within the 8 MiB cap, mounting a single small image on a high-CPU host is sufficient to pin significant vmalloc memory. Consult the kernel commits referenced below for the specific allocation paths and configuration changes.

Refer to Kernel Commit 0c67690 and Kernel Commit e8b3d09 for the fix implementation.

Detection Methods for CVE-2026-80892

Indicators of Compromise

Unexpectedly high vmalloc usage reported by /proc/meminfo after mounting EROFS images with LZMA compression.
Sustained memory consumption attributable to the erofs module that does not release after unmounts.
Unusual EROFS mount activity involving images from untrusted sources or user-controlled paths.

Detection Strategies

Audit /proc/vmallocinfo for large allocations attributed to erofs LZMA decoder state.
Track kernel module memory footprints over time and correlate spikes with EROFS mount events.
Inventory hosts by CPU count and identify high-core systems running kernels without the stream cap.

Monitoring Recommendations

Alert on unexpected EROFS mount operations, particularly on servers and container hosts.
Monitor vmalloc pressure alongside broader memory telemetry to catch resource exhaustion trends early.
Include kernel version and EROFS configuration state in host inventory data for patch prioritization.

How to Mitigate CVE-2026-80892

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor-supplied kernels are available.
Set the lzma_streams module parameter explicitly to a reasonable value on high-CPU systems until patched kernels are deployed.
Restrict which users or workloads can mount EROFS images, particularly from untrusted sources.

Patch Information

The fix is available in multiple stable kernel branches through the following commits: Kernel Commit 0c67690, Kernel Commit 5aaa06d, Kernel Commit 682cb3e, Kernel Commit c9b47e6, Kernel Commit e52da16, and Kernel Commit e8b3d09. Rebuild kernels with CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS set to a value appropriate for the deployment.

Workarounds

Explicitly set the lzma_streams module parameter at load time to override the CPU-derived default.
Avoid mounting EROFS images from untrusted sources on high-CPU hosts until the kernel is patched.
Unload the erofs module when it is not in use to release pinned vmalloc memory.

bash

# Cap the LZMA stream pool at module load time
echo "options erofs lzma_streams=4" | sudo tee /etc/modprobe.d/erofs.conf

# Reload the module to apply the parameter
sudo modprobe -r erofs
sudo modprobe erofs

# Verify the active parameter value
cat /sys/module/erofs/parameters/lzma_streams