The vulnerability arises from the erofs filesystem’s use of an external LZ4 compression library that was enhanced with a rolling decompression optimisation based on a 64 KiB sliding window. The external LZ4 implementation can perform backward copies of non‑overlapping memory ranges, breaking the rolling assumption. As a result the optimisation was disabled to guarantee correct decompression behaviour, but the change increases the runtime memory footprint of erofs operations.

All installations of the Linux kernel that include the erofs filesystem are affected. The CVE does not list specific kernel versions; therefore any distribution using erofs, whether as a root or data filesystem, should treat all recent kernel releases containing erofs as potentially impacted until the mitigation is applied.

The CVSS score is 5.5 and the EPSS score is below 1 %, indicating moderate severity and a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to trigger erofs decompression, for example by creating or accessing files on an erofs‑mounted filesystem. No remote exploitation pathway is documented. The primary risk is a higher memory consumption that could affect system performance or stability, while integrity concerns are mitigated by disabling the problematic optimisation.