CVE-2026-98005 erofs: delimit inode_share cache key components
An ambiguity in EROFS inode cache key encoding could allow incorrect cache lookups, potentially leading to data integrity issues or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98005?
CVE-2026-98005 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
erofs: delimit inode_share cache key components
Previously, inode_share keys were encoded as follows:
fingerprint || domain_id
It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won't be parsed as part of a domain ID.
Change the key encoding as follows:
domain_id || '\0' || fingerprint
Since domain_id is a NUL-terminated string, this makes the in-memory key indices unambiguous.
Which versions are affected by CVE-2026-98005?
How do I fix CVE-2026-98005?
Apply the vendor's patch.
Is CVE-2026-98005 being exploited?
There is no known exploitation of CVE-2026-98005 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98005, GHSA-cmc8-g72c-8f33, UBUNTU-CVE-2026-98005.