CVE-2026-46078erofs: fix the out-of-bounds nameoff handling for trailing dirents
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs. If a crafted EROFS has a trailing dirent with nameoff >= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block. nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1]. [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3aa8ec716e52c02360457fa018296629b4d0becf before a8ee527807f7d97e55ce2ef2906f7f34975eb1c7; from 3aa8ec716e52c02360457fa018296629b4d0becf before aa16dca1b062355181ef215229eeac249d7c0d61; from 3aa8ec716e52c02360457fa018296629b4d0becf before 80a23c6d1aba35be8746d74ac14e6ba5ae46da21; from 3aa8ec716e52c02360457fa018296629b4d0becf before 222055e6b4063abd2d9e13c3d49bbd1724c50789; from 3aa8ec716e52c02360457fa018296629b4d0becf before 48b27a955d22391c7f30169fa7b6b2e1977f1ce4; from 3aa8ec716e52c02360457fa018296629b4d0becf before 8ebb951a284b7446e025afc7dc5e9516ef9a7214; 3aa8ec716e52c02360457fa018296629b4d0becf builds before 1d55445226c75ddd4e78b09b3e7d99109b28c366; from 3aa8ec716e52c02360457fa018296629b4d0becf before d18a3b5d337fa412a38e776e6b4b857a58836575 | CNA record |
linux linux_kernel linux:linux_kernel | from 4.19 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4 | NVD |
References
- https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7patch
- https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61patch
- https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21patch
- https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789patch
- https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4patch
- https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214patch
- https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366patch
- https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.