CVE-2026-45999 erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

High 7.1 Published 27 May 2026 Updated 5 Aug 2026

A crafted EROFS image triggers an unsigned underflow in the kernel, causing out-of-bounds memory access and potential system crash or information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-45999?

CVE-2026-45999 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) properly: "outpages - inpages" wraps to a large value and the subsequent rq->out[] access reads past the decompressed_pages array.

However, such crafted cases can correctly result in a corruption report in the normal LZ4 non-inplace path.

Let's add an additional check to fix this for backporting.

Reproducible image (base64-encoded gzipped blob):

H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz 2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w ywAAAAAAAADwu14ATsEYtgBQAAA=

$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt $ dd if=/mnt/data of=/dev/null bs=4096 count=1

Weakness: CWE-191

Which versions are affected by CVE-2026-45999?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-45999?

Apply the vendor's patch.

Is CVE-2026-45999 being exploited?

There is no known exploitation of CVE-2026-45999 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-88745, BELL-CVE-2026-45999, DEBIAN-CVE-2026-45999, GHSA-xqmq-2p4j-99x8, ROOT-OS-DEBIAN-12-CVE-2026-45999, ROOT-OS-UBUNTU-2204-CVE-2026-45999 and 2 more.