All vulnerabilities
CVE-2026-97605

Linux: erofs: preserve LZMA decoders on resize failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in604ce546e1b9f35b1f45588004f53fac6b2869c1Also 0b3c8c39e50249470f00a5f73c288b95a55ab576, 38e9e07ac02a9453a117410776f1502a9980997e and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 604ce546e1b9f35b1f45588004f53fac6b2869c1LinuxCVE List
  • 0b3c8c39e50249470f00a5f73c288b95a55ab576LinuxCVE List
  • 38e9e07ac02a9453a117410776f1502a9980997eLinuxCVE List
  • 617d0d8d199ba1790c94310fd75a22d01c97a8d6LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: preserve LZMA decoders on resize failure

The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is put back on the list with state == NULL. z_erofs_lzma_max_dictsize is still advanced as if the whole pool had been resized.

An existing LZMA mount can select the broken stream and pass NULL to xz_dec_microlzma_reset(). A retry at the same size also skip another resize attempt. Since the global maximum was advanced, thus, the invalid state is left unrepaired.

Allocate each replacement before freeing the old decoder, temporarily retaining one old decoder during allocation. Stop at the first failure and advance z_erofs_lzma_max_dictsize only after all streams satisfy the request.

Record each stream's dictionary capacity so retries can skip streams already enlarged before a partial failure.

Text from CVE List

Affected versions 12

  • Linuxaffected: 622ceaddb7649ca328832f50ba1400af778d75fa before db0c3465b54a16debc089b2b3bda251d26c953d0CVE List
  • Linuxaffected: 622ceaddb7649ca328832f50ba1400af778d75fa before 604ce546e1b9f35b1f45588004f53fac6b2869c1CVE List
  • Linuxaffected: 622ceaddb7649ca328832f50ba1400af778d75fa before 0b3c8c39e50249470f00a5f73c288b95a55ab576CVE List
  • Linuxaffected: 622ceaddb7649ca328832f50ba1400af778d75fa before 38e9e07ac02a9453a117410776f1502a9980997eCVE List
  • Linuxaffected: 622ceaddb7649ca328832f50ba1400af778d75fa before 617d0d8d199ba1790c94310fd75a22d01c97a8d6CVE List
  • Linuxaffected: 5.16CVE List
  • Linuxunaffected: all versions before 5.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5