Technical impact
A race condition occurs when the erofs decompression routine is scheduled to run after the file system is unmounted, causing a use‑after‑free of the superblock structure (sbi->sync_decompress). The memory corruption that results can be exploited by an attacker to gain arbitrary execution in kernel space, leading to privilege escalation or a system crash.
Affected Systems
All Linux kernel configurations that compile with erofs support are potentially affected. Any release containing the erofs module prior to the commit that introduced the fix is vulnerable. The vulnerability is active only on systems that mount an erofs file system and expose the ability to unmount it.
Risk and Exploitability
The CVSS score of 7.8 indicates a high risk, while the EPSS score of < 1% suggests that exploitation, if attempted, is unlikely to be widely observed. The vulnerability is not listed in the CISA KEV catalog at this time. The likely attack vector is a local entity that can trigger an unmount on an erofs file system; based on the description, it is inferred that the attacker must have permission to unmount the file system, typically root or a user with remount capabilities. If such an attacker can cause the unmount sequence to proceed while z_erofs_decompress_kickoff() is still queued, the use‑after‑free can be triggered, leading to kernel memory corruption. No public exploit has been reported yet.
Ubuntu USN