CVE-2026-46329

A flaw was found in the Linux kernel's erofs filesystem. This vulnerability occurs due to improper handling of I/O requests that extend beyond the end of a file-backed filesystem. An attacker could potentially exploit this to read uninitialized memory, leading to information disclosure. This issue should be addressed to prevent unauthorized access to sensitive data.

This vulnerability is rated Moderate rather than Low because an authenticated local user with permissions to mount file-backed EROFS images could trigger out-of-bounds memory access or kernel instability. The risk is constrained because mounting custom filesystem images typically requires administrative privileges or access to unprivileged user namespaces. Earlier releases, including Red Hat Enterprise Linux 8 and 9, are not affected as they do not contain the affected code introduced in newer upstream kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.