In Linux kernels that support the EROFS filesystem, the decompression component allocates a global LZMA stream pool sized on the number of CPUs, allocating up to 8 MiB of dictionary memory per stream. When the higher‑level module parameter is unset, mounting an EROFS image can therefore reserve hundreds of megabytes of vmalloc memory in a very small filesystem image. The extra memory holds decoder state until the erofs module is unloaded, which can consume large amounts of kernel virtual memory and lead to a denial‑of‑service condition if the system runs low on vmalloc space.

This flaw affects any Linux distribution that compiles the EROFS filesystem with default settings and does not explicitly set the lzma_streams module parameter. All kernels that enable EROFS by default or where the module is explicitly loaded are vulnerable. The issue is limited to systems that mount EROFS images; other kernel subsystems are unaffected.

The vulnerability does not provide remote code execution or privilege escalation; it primarily allows an attacker to consume kernel virtual memory and cause a denial of service. The current CVSS or EPSS scores are not available and the flaw is not listed in the CISA KEV catalog, suggesting limited exploitation risk. However, on machines with many CPUs, the default unbounded allocation can quickly consume hundreds of megabytes, making the attack path practical on high‑performance servers that mount EROFS volumes. Administrators who control the system can mitigate by capping the stream count, but an attacker with the ability to mount a crafted image or interrupt the kernel is able to trigger the denial of service.