In the Linux kernel, the following vulnerability has been resolved:
erofs: fix inconsistent per-file compression format
EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization.
However, syzkaller can generate inconsistent crafted images that use an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA algorithmtype even it's not set in `sbi->available_compr_algs`. This can lead to an unexpected "BUG: kernel NULL pointer dereference" if the corresponding decompressor isn't built-in.
Fix this by checking against `sbi->available_compr_algs` for each m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 22, 2024 |
| Suse | — | Upgrade kernel-rt-extraUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kernel-debugUpgrade kernel-source-vanillaUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade dtb-sprdUpgrade kernel-debug-develUpgrade dtb-amazonUpgrade dtb-hisiliconUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-default-baseUpgrade dtb-xilinxUpgrade dtb-nvidiaUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade kselftests-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-lgUpgrade kernel-default-livepatch-develUpgrade dtb-exynosUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade kernel-default-optionalUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-default-livepatchUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-rt-develUpgrade kernel-obs-buildUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade dlm-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade dlm-kmp-defaultUpgrade dtb-apmUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rt_debugUpgrade kernel-devel-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-appleUpgrade dtb-armUpgrade kernel-azure-extraUpgrade gfs2-kmp-rtUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-docsUpgrade kernel-docs-htmlUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-marvellUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmallUpgrade kernel-debug-livepatch-develUpgrade kernel-source-rtUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade dtb-socionextUpgrade reiserfs-kmp-64kb | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Feb 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 28, 2026 | Feb 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub