CVE-2026-80892erofs: cap LZMA stream pool size
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_erofs_load_lzma_config() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded. Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly. Bound the default stream count by a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzma_streams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 622ceaddb7649ca328832f50ba1400af778d75fa before 682cb3ece37fc5141e73bc726ccf4adb833e5189; from 622ceaddb7649ca328832f50ba1400af778d75fa before e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4; 622ceaddb7649ca328832f50ba1400af778d75fa builds before 0c676903cb2a61992ded8e7907609cc6b0f11744; 622ceaddb7649ca328832f50ba1400af778d75fa builds before 5aaa06dfc10f8398c8807453dbec738ea9af10e4; from 622ceaddb7649ca328832f50ba1400af778d75fa before e52da169b8c0d19bb2d803f2a07fe0e5a00462d6; from 622ceaddb7649ca328832f50ba1400af778d75fa before c9b47e6b23114e939b17f818471c7a46e59006e7 | CNA record |
References
- https://git.kernel.org/stable/c/682cb3ece37fc5141e73bc726ccf4adb833e5189
- https://git.kernel.org/stable/c/e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4
- https://git.kernel.org/stable/c/0c676903cb2a61992ded8e7907609cc6b0f11744
- https://git.kernel.org/stable/c/5aaa06dfc10f8398c8807453dbec738ea9af10e4
- https://git.kernel.org/stable/c/e52da169b8c0d19bb2d803f2a07fe0e5a00462d6
- https://git.kernel.org/stable/c/c9b47e6b23114e939b17f818471c7a46e59006e7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.