The Linux kernel EROFS driver allows I/O requests that exceed the logical size of a file-backed mount to return data from the underlying backing file instead of zero‑filling as expected. This unintended read can expose data that does not belong to the mounted image, potentially revealing confidential information to a user capable of performing such reads.

All Linux kernels that incorporate the EROFS filesystem driver and have not yet integrated the patch that zero‑fills out‑of‑bounds reads are affected. The advisory lists the relevant commits but does not pin a specific kernel version, so any release prior to those commits may remain vulnerable.

The CVSS score of 5.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalogue. Based on the description, an attacker with the ability to read beyond the end of a file on a mounted EROFS image—typically a local user or process with access to that filesystem—could trigger the out‑of‑bounds read and gain access to data from the backing file. The risk is therefore moderate for attackers, and the impact is the disclosure of data that should otherwise be inaccessible.