A vulnerability in the erofs filesystem of the Linux kernel allows an out‑of-bounds read when a crafted filesystem image contains a trailing directory entry whose name offset exceeds the allocated buffer. The unchecked name offset causes the kernel to call strnlen() with an overly large limit, leading to a read past the end of the data block. This overread can expose kernel memory contents, potentially revealing secrets or other sensitive information, and could be leveraged as a foothold for further privilege escalation. The weakness is a classic buffer overread and improper bounds checking, identified as CWE‑805.

All Linux kernel builds that compile the erofs filesystem module and have not applied the recent patch are vulnerable. The advisory does not list specific kernel releases, so any unpatched kernel capable of mounting erofs filesystems is affected.

The CVSS score of 7.1 reflects high severity. With an EPSS score of <1%, the likelihood of exploitation remains unclear, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a maliciously crafted EROFS image that can be mounted, implying a local attack scenario or a scenario where the target system mounts untrusted filesystems, such as a networked file share or a container image. Once the filesystem is mounted, the kernel performs the unbounded read and leaks memory contents. The attack vector is inferred from the description and is not explicitly stated in the payload.