CVE-2026-89602: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89602 Overview

CVE-2026-89602 is a vulnerability in the Linux kernel's erofs (Enhanced Read-Only File System) compression subsystem. The flaw resides in the global buffer resize logic used by the zipped erofs (z_erofs) code path. When z_erofs_gbuf_nrpages fails to advance after a partial resize, retry attempts revisit buffers that were already enlarged. This leads to two failure modes: an -ENOMEM return from alloc_pages_bulk() and a memory copy that writes more pointers than a smaller temporary array can hold. The kernel patch skips buffers that already satisfy the requested size to avoid the inconsistency.

Critical Impact
A local user triggering an erofs global buffer resize failure can cause kernel memory corruption or denial of service on affected Linux systems.

Affected Products

Linux kernel branches containing the z_erofs global buffer implementation
Distributions shipping vulnerable stable kernel builds prior to the referenced patches
Systems mounting or decompressing erofs images under memory pressure

Discovery Timeline

2026-09-11 - CVE-2026-89602 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89602

Vulnerability Analysis

The erofs compression layer maintains a pool of global buffers used during decompression. The counter z_erofs_gbuf_nrpages records the guaranteed minimum page count across the entire pool. The resize routine advances this counter only after every buffer in the pool has been grown to the new target size.

If the resize partially succeeds and then fails, subsequent retries do not know which buffers already reached the target. The retry logic re-enters the same allocation path for buffers that were already resized. This produces incorrect return values and inconsistent buffer state during recovery.

The attack vector is local and requires user interaction, consistent with a triggered mount or decompression operation of a crafted or oversized erofs image under memory pressure.

Root Cause

The root cause is a state-tracking defect in the erofs global buffer resize routine. Because z_erofs_gbuf_nrpages is not updated per-buffer, the retry path cannot distinguish already-enlarged buffers from pending ones. Retrying the same target size calls alloc_pages_bulk() with no pages to add, and the unchanged return value is interpreted as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and then copies more existing pointers than the destination can hold, producing an out-of-bounds write in kernel memory.

Attack Vector

Exploitation requires local access and a triggering action such as mounting or reading from an erofs volume that forces a global buffer resize. Under memory pressure, alloc_pages_bulk() failures during resize expose the retry path. The out-of-bounds pointer copy occurs in kernel context and can corrupt adjacent kernel heap data. Successful exploitation can lead to denial of service, memory disclosure, or in the worst case privilege escalation depending on the corrupted allocation neighbor.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Kernel Patch 7267557, Kernel Patch 7f4a89d4, and Kernel Patch a7d097cf for the upstream fixes.

Detection Methods for CVE-2026-89602

Indicators of Compromise

Kernel oops or panic traces referencing z_erofs_gbuf, alloc_pages_bulk, or erofs decompression symbols
Unexpected -ENOMEM errors during erofs mount or read operations correlated with high memory pressure
Slab or page allocator corruption warnings appearing after erofs image access

Detection Strategies

Enable kernel diagnostics such as KASAN or SLUB_DEBUG in test environments to surface out-of-bounds writes originating in erofs code paths
Collect kernel logs centrally and search for erofs subsystem errors alongside allocation failures
Inventory hosts running kernels that predate the referenced upstream commits and prioritize them for review

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized logging or SIEM platform for correlation
Alert on kernel panics or repeated erofs errors on systems that mount user-supplied filesystem images
Track container and sandbox runtimes that use erofs-backed images, since these can trigger the resize path

How to Mitigate CVE-2026-89602

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry as soon as vendor builds are available
Restrict the ability of unprivileged users to mount arbitrary erofs images through user namespaces or FUSE wrappers
Reduce memory pressure on hosts that regularly decompress erofs content to lower the probability of triggering the resize retry

Patch Information

The fix is delivered by three upstream commits: Kernel Patch 7267557, Kernel Patch 7f4a89d4, and Kernel Patch a7d097cf. The patches modify the resize routine to skip buffers that already satisfy the requested page count. Once all remaining buffers catch up, z_erofs_gbuf_nrpages advances again to describe the new guaranteed minimum. Update to distribution kernels that incorporate these commits.

Workarounds

Avoid mounting untrusted or attacker-controlled erofs images on unpatched systems
Disable or blacklist the erofs kernel module on hosts that do not require it using modprobe.d configuration
Constrain container runtimes to use trusted image sources until patched kernels are deployed

bash

# Blacklist the erofs module on systems that do not require it
echo 'blacklist erofs' | sudo tee /etc/modprobe.d/blacklist-erofs.conf
sudo depmod -a
# Verify the module is not currently loaded
lsmod | grep erofs