CVE-2026-98005
Linux: erofs: delimit inode_share cache key components
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16322a67336cfeea0af4b05206ef8d0e0eda55bbAlso 96bf9831fbf423b8104f7948cd8fe7007ecfb46cCVE List
What fixes it
- 16322a67336cfeea0af4b05206ef8d0e0eda55bbLinuxCVE List
- 96bf9831fbf423b8104f7948cd8fe7007ecfb46cLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
erofs: delimit inode_share cache key components
Previously, inode_share keys were encoded as follows:
fingerprint || domain_id
It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won't be parsed as part of a domain ID.
Change the key encoding as follows:
domain_id || '\0' || fingerprint
Since domain_id is a NUL-terminated string, this makes the in-memory key indices unambiguous.
Text from CVE List
Affected versions 6
- Linuxaffected: e0bf7d1c074dc4252223ae897560345ccc24100d before 16322a67336cfeea0af4b05206ef8d0e0eda55bbCVE List
- Linuxaffected: e0bf7d1c074dc4252223ae897560345ccc24100d before 96bf9831fbf423b8104f7948cd8fe7007ecfb46cCVE List
- Linuxaffected: 7.0CVE List
- Linuxunaffected: all versions before 7.0CVE List
- Linuxunaffected: 7.2.7 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List