CVE-2026-90161

A flaw was found in the Linux kernel's erofs filesystem. A local attacker could craft a malicious erofs image containing invalid interlaced ztailpacking pclusters. When this image is processed, it could lead to an out-of-bounds read from kernel memory. This vulnerability may allow an attacker to disclose sensitive kernel memory to userspace.

An out-of-bounds read in the EROFS decompression path can occur when a crafted image contains invalid interlaced ztailpacking pclusters. The kernel may read beyond the expected mapped page data and copy unrelated kernel memory into userspace-visible page cache when the affected file data is read. For the CVSS the PR:L is used in the paranoid score because a local user or service account may be able to provide or mount crafted EROFS images in container, appliance, or automount workflows, even though direct mounting is often administrative. The issue is local and is not network reachable by itself. Impact is information disclosure of kernel memory with no direct evidence of integrity impact or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.