In the Linux kernel, the following vulnerability has been resolved:
erofs: fix managed cache race for unaligned extents
After unaligned compressed extents were introduced, the following race could occur:
[Thread 1] [Thread 2] (z_erofs_fill_bio_vec) <handle a Z_EROFS_PREALLOCATED_FOLIO folio> ... filemap_add_folio (1) (z_erofs_bind_cache) <the same folio is found..> .. .. folio_attach_private (2) filemap_add_folio (3) again
Since (1) is executed but (2) hasn't been executed yet, it's possible that another thread finds the same managed folio in z_erofs_bind_cache() for a different pcluster and calls filemap_add_folio() again since folio->private is still Z_EROFS_PREALLOCATED_FOLIO.
Fix this by explicitly clearing folio->private before making the folio visible in the managed cache so that another pcluster can simply wait on the locked managed folio as what we did for other shared cases [1].
This only impacts unaligned data compression (`-E48bit` with zstd, for example).
[1] Commit 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of crafted images properly") was originally introduced to handle crafted overlapped extents, but it addresses unaligned extents as well.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.18.35-68.127Upgrade kernel6.18-modules-extraUpgrade perf6.18-debuginfoUpgrade python3-perf6.18Upgrade kernel6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade bpftool6.18-debuginfoUpgrade perf6.18Upgrade bpftool6.18Upgrade microvm-kernel6.18Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-headersUpgrade kernel6.18-tools-develUpgrade kernel6.18Upgrade kernel6.18-develUpgrade kernel6.18-toolsUpgrade kernel6.18-modules-extra-common | Aug 10, 2026 | Jul 19, 2026 |
| Redhat_linux | — | — | Jul 23, 2026 | Jul 19, 2026 |
| Ubuntu | — | Upgrade linux-image-azure-7.0Upgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-7.0.0-1009-awsUpgrade linux-image-awsUpgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-azureUpgrade linux-image-raspi-7.0Upgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-nvidia-bosUpgrade linux-image-azure-fdeUpgrade linux-image-7.0.0-2016-nvidia-bosUpgrade linux-image-raspiUpgrade linux-image-aws-7.0Upgrade linux-image-oracle-7.0Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-ibmUpgrade linux-image-aws-64k-7.0Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-nvidia-7.0Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-gcpUpgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-bos-64kUpgrade linux-image-7.0.0-2016-nvidia-bos-64kUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-azure-fde-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-gcp-7.0Upgrade linux-image-7.0.0-1014-azureUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-oracleUpgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-aws-64kUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64k | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub