CVE-2026-97605 - Vulnerability Details

- erofs: preserve LZMA decoders on resize failure

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: preserve LZMA decoders on resize failure

The pool-resize path frees each stream's old decoder before allocating
its replacement. If an allocation fails after some streams have already
been replaced, the failed stream is put back on the list with state ==
NULL. z_erofs_lzma_max_dictsize is still advanced as if the whole
pool had been resized.

An existing LZMA mount can select the broken stream and pass
NULL to xz_dec_microlzma_reset(). A retry at the same size also
skip another resize attempt. Since the global maximum was advanced,
thus, the invalid state is left unrepaired.

Allocate each replacement before freeing the old decoder, temporarily
retaining one old decoder during allocation. Stop at the first failure
and advance z_erofs_lzma_max_dictsize only after all streams satisfy
the request.

Record each stream's dictionary capacity so retries can skip streams
already enlarged before a partial failure.

Published: 2026-09-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel bug in the erofs filesystem leads to improper destruction of LZMA decoder objects during a pool resize. When an allocation fails after some streams have already had new decoders allocated, the affected stream’s decoder pointer is set to NULL while the global maximum dictionary size is still increased. A subsequent mount that selects this corrupted stream will pass a NULL pointer to the decoder reset routine, causing a kernel panic. The result is a denial of service via a kernel crash.

Affected Systems

All Linux kernel installations that expose erofs support with LZMA decoding are vulnerable, provided the kernel has not been patched for the resize handling bug.

Risk and Exploitability

The vulnerability is local; an attacker must be able to mount an erofs filesystem with LZMA support or manipulate the filesystem data to trigger the resize failure. No publicly known exploitation is available and the issue is not listed in the CISA KEV catalog. The EPSS score is not available. The risk remains high for affected systems that allow mounting of LZMA‑enabled erofs filesystems, but it does not extend to users without mount privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`622ceaddb7649ca328832f50ba1400af778d75fa`	affected	< 604ce546e1b9f35b1f45588004f53fac6b2869c1
`622ceaddb7649ca328832f50ba1400af778d75fa`	affected	< 0b3c8c39e50249470f00a5f73c288b95a55ab576
`622ceaddb7649ca328832f50ba1400af778d75fa`	affected	< 38e9e07ac02a9453a117410776f1502a9980997e
`622ceaddb7649ca328832f50ba1400af778d75fa`	affected	< 617d0d8d199ba1790c94310fd75a22d01c97a8d6

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[622ceaddb7649ca328832f50ba1400af778d75fa,604ce546e1b9f35b1f45588004f53fac6b2869c1)`	affected	code_commit	—
`[622ceaddb7649ca328832f50ba1400af778d75fa,0b3c8c39e50249470f00a5f73c288b95a55ab576)`	affected	code_commit	—
`[622ceaddb7649ca328832f50ba1400af778d75fa,38e9e07ac02a9453a117410776f1502a9980997e)`	affected	code_commit	—
`[622ceaddb7649ca328832f50ba1400af778d75fa,617d0d8d199ba1790c94310fd75a22d01c97a8d6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.16`	affected	generic	—
`[0,5.16)`	unaffected	generic	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a patched release that includes the erofs resize handling fix.
Reboot the system to load the new kernel.
Remount any erofs filesystems after reboot so the corrected decoder logic is exercised.

Generated by OpenCVE AI on September 25, 2026 at 23:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b3c8c39e50249470f00a5f73c288b95a55ab576
https://git.kernel.org/stable/c/38e9e07ac02a9453a117410776f1502a9980997e
https://git.kernel.org/stable/c/604ce546e1b9f35b1f45588004f53fac6b2869c1
https://git.kernel.org/stable/c/617d0d8d199ba1790c94310fd75a22d01c97a8d6

History

Fri, 25 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: erofs: preserve LZMA decoders on resize failure The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is put back on the list with state == NULL. z_erofs_lzma_max_dictsize is still advanced as if the whole pool had been resized. An existing LZMA mount can select the broken stream and pass NULL to xz_dec_microlzma_reset(). A retry at the same size also skip another resize attempt. Since the global maximum was advanced, thus, the invalid state is left unrepaired. Allocate each replacement before freeing the old decoder, temporarily retaining one old decoder during allocation. Stop at the first failure and advance z_erofs_lzma_max_dictsize only after all streams satisfy the request. Record each stream's dictionary capacity so retries can skip streams already enlarged before a partial failure.
Title		erofs: preserve LZMA decoders on resize failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b3c8c39e50249470f00a5f73c288b95a55ab576 https://git.kernel.org/stable/c/38e9e07ac02a9453a117410776f1502a9980997e https://git.kernel.org/stable/c/604ce546e1b9f35b1f45588004f53fac6b2869c1 https://git.kernel.org/stable/c/617d0d8d199ba1790c94310fd75a22d01c97a8d6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:22:17.233Z

Updated: 2026-09-25T10:22:17.233Z

Reserved: 2026-09-24T16:01:01.158Z

Link: CVE-2026-97605

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:14.543

Modified: 2026-09-25T11:17:14.543

Link: CVE-2026-97605

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T23:30:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object