CVE-2026-89602

A flaw was found in the erofs (Enhanced Read-Only File System) component of the Linux kernel. This vulnerability occurs when resizing global buffers, specifically if a resize operation fails after some buffers have already been enlarged. A subsequent retry can lead to memory corruption by attempting to copy more data than an allocated buffer can hold. Additionally, retrying with the same size can result in an out-of-memory error, causing a denial of service.

This vulnerability is rated with a Moderate severity because exploitation requires local access and the capability to mount or process an EROFS filesystem under low-memory conditions that trigger resize failures. In standard Red Hat deployments, mounting arbitrary file systems is restricted to administrative users, significantly limiting the exposure for unprivileged attackers. Furthermore, earlier enterprise versions such as Red Hat Enterprise Linux 8 and 9 do not contain the affected code and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.