The vulnerability is an unsigned underflow in the erofs filesystem’s LZ4 in‑place decompression routine. When an attacker supplies a crafted image that contains illegal extents, the calculation of outpages minus inpages wraps to a very large value. This causes the kernel to read data past the end of the decompressed_pages array, leading to an out‑of‑bounds memory read and potential corruption. In the non‑in‑place path the error is caught and produces a corruption report, but the in‑place path can propagate the defect.

All Linux kernel installations that enable the erofs filesystem are affected. No specific kernel version ranges were enumerated in the advisory, so any kernel that supports erofs and could mount an attacker‑controlled erofs image is potentially vulnerable.

The CVSS score is 7.1 and the EPSS score is < 1%, which provides a clearer assessment of the risk. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to supply and mount a malicious erofs image on the target system. On successful exploitation the kernel may crash or hang, resulting in a denial of service. Because the bug is local to the filesystem layer, it can be mitigated by restricting who can create or mount erofs images.