The vulnerability arises from the integration of the external LZ4 compression library into the Linux kernel’s erofs filesystem. The rolling decompression technique relies on a 64 KiB sliding window of decompressed data, but the upstream LZ4 implementation can copy memory backwards when source and destination ranges do not overlap, thereby breaking the rolling assumption. When this occurs the filesystem may produce corrupted data or, at the very least, incur a higher runtime memory footprint. The developers resolved the issue by disabling LZ4 rolling decompression for the time being and introducing a reserved buffer pool to mitigate the memory cost. The main impact is a potential loss of data integrity and an elevated memory requirement for erofs operations.

All installations employing the Linux kernel’s erofs filesystem are affected. This includes any distribution that uses erofs as its root or data filesystem. No specific kernel versions are listed in the CVE; administrators should treat all recent kernel releases that include erofs as potentially impacted until a patch is applied.

The CVSS score is not provided, and the EPSS is unavailable, indicating limited available exploitation data. The vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to manipulate or trigger erofs decompression operations (e.g., via crafted files). Because the issue is an implementation flaw that can corrupt data, the risk is medium to high for affected systems, particularly those with sensitive or critical data stored in erofs. No remote exploitation path has been documented, but the integrity impact warrants prompt remediation.