CVE-2026-45943

A flaw was found in the Linux kernel's erofs filesystem. This issue occurs when compressed folios for ztailpacking pclusters are not validated before being added to I/O chains. An attacker could potentially trigger a NULL pointer dereference, leading to a system crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because triggering the flaw requires local privileges to mount or access a specially prepared EROFS image, with the consequence restricted to a local system crash rather than arbitrary code execution or data exposure. Under default Red Hat Enterprise Linux configurations, standard unprivileged users cannot mount arbitrary filesystem images without administrative delegation or unprivileged user namespace capabilities. Furthermore, the vulnerable code introduced in upstream kernel 5.17 is not present in older enterprise releases such as RHEL 7, 8, and 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.