CVE-2026-80899

A flaw was found in the Linux kernel's EROFS (Enhanced Read-Only File System) fscache backend. This component, which provided image lazy pulling functionality, contained implementation issues that led to its deprecation and subsequent removal. While the specific impact of these issues is not detailed, their presence necessitated the removal of the feature to prevent potential security vulnerabilities. Equivalent functionality is now available through EROFS file-backed mounts and fanotify pre-content hooks.

The affected area is the deprecated EROFS over fscache on demand read backend, which was used for lazy image pulling through fscache and cachefiles integration. The visible diff does not show a concrete UAF, OOB write, arbitrary write, or information leak primitive, so the base impact is limited and mainly represents possible local denial of service or incorrect behavior when the feature is enabled. For the CVSS the PR:L is used for the paranoid score because delegated mount workflows, container image services, or reduced capability root contexts may expose this path without full host administrator control. The issue is not directly network reachable as packet traffic, but it may be reachable through a local or internal image management workflow where EROFS fscache based lazy pulling is used. Impact is at least availability risk in affected deployments and in the worst still defensible case may include limited confidentiality or integrity impact due to unspecified implementation issues.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.