CVE-2026-46078

A flaw was found in the Linux kernel's EROFS filesystem. A local attacker could exploit an out-of-bounds read vulnerability by creating a specially crafted EROFS image. This issue arises from incorrect calculations of directory entry name lengths, which can cause the system to read beyond allocated memory. Successful exploitation could lead to information disclosure or a system crash (denial of service).

This vulnerability is rated Moderate because exploitation requires local privileges or physical access to mount a malformed storage image, primarily resulting in a kernel crash and denial of service. Under standard Red Hat Enterprise Linux configurations, mounting arbitrary storage images is restricted to administrative users or controlled virtualization and container workflows. Additionally, this flaw is not present in Red Hat Enterprise Linux 8.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.