In the Linux kernel, the following vulnerability has been resolved:
erofs: fix managed cache race for unaligned extents
After unaligned compressed extents were introduced, the following race could occur:
[Thread 1] [Thread 2] (z_erofs_fill_bio_vec) <handle a Z_EROFS_PREALLOCATED_FOLIO folio> ... filemap_add_folio (1) (z_erofs_bind_cache) <the same folio is found..> .. .. folio_attach_private (2) filemap_add_folio (3) again
Since (1) is executed but (2) hasn't been executed yet, it's possible that another thread finds the same managed folio in z_erofs_bind_cache() for a different pcluster and calls filemap_add_folio() again since folio->private is still Z_EROFS_PREALLOCATED_FOLIO.
Fix this by explicitly clearing folio->private before making the folio visible in the managed cache so that another pcluster can simply wait on the locked managed folio as what we did for other shared cases [1].
This only impacts unaligned data compression (`-E48bit` with zstd, for example).
[1] Commit 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of crafted images properly") was originally introduced to handle crafted overlapped extents, but it addresses unaligned extents as well.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.18-debuginfoUpgrade python3-perf6.18Upgrade perf6.18Upgrade python3-perf6.18-debuginfoUpgrade kernel-livepatch-6.18.35-68.127Upgrade bpftool6.18-debuginfoUpgrade bpftool6.18Upgrade microvm-kernel6.18Upgrade kernel6.18-modules-extraUpgrade kernel6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel6.18Upgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18-headersUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-develUpgrade kernel6.18-tools | Aug 10, 2026 | Jul 19, 2026 |
| Redhat_linux | — | — | Jul 23, 2026 | Jul 19, 2026 |
| Ubuntu | — | Upgrade linux-image-aws-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-oracleUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-1010-azureUpgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-7.0.0-1014-azureUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-7.0.0-2016-nvidia-bos-64kUpgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-gcp-7.0Upgrade linux-image-azure-fde-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-azure-7.0Upgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-raspiUpgrade linux-image-oracle-7.0Upgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-awsUpgrade linux-image-7.0.0-1009-awsUpgrade linux-image-azureUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-nvidia-bosUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-raspi-7.0Upgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fdeUpgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-2016-nvidia-bosUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-ibmUpgrade linux-image-aws-64k-7.0Upgrade linux-image-nvidia-7.0 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub