CVE-2026-80892

A flaw was found in the Linux kernel's EROFS (Enhanced Read-Only File System) component. On systems with a high number of processing units, mounting a specially crafted EROFS image can cause the kernel to allocate an excessive amount of memory for LZMA decompression streams. This uncontrolled memory allocation can lead to a denial of service (DoS) by consuming critical system resources.

This vulnerability is rated as having a Low severity for Red Hat because mounting filesystems generally requires elevated privileges, restricting the attack vector to users who already possess administrative access. Additionally, the excessive memory consumption primarily affects systems with very high processor core counts when processing maliciously structured images, limiting the blast radius in typical environments. Older enterprise distributions, including Red Hat Enterprise Linux 8 and 9, do not include the affected code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.