CVE-2026-97605

A flaw was found in the Linux kernel. When resizing the decompression stream pool in the Enhanced Read-Only File System (EROFS) encounters a memory allocation failure, an uninitialized stream is improperly retained in the active pool. A local user accessing or decompressing an affected filesystem can trigger a null pointer dereference on this invalid stream, resulting in a kernel crash and Denial of Service (DoS).

This vulnerability is assessed as having Low impact for Red Hat products because triggering it requires local access, an active LZMA-compressed EROFS mount, and a rare memory allocation failure during decoder pool resizing. In standard Red Hat Enterprise Linux environments, EROFS is not used for primary storage, and unprivileged users cannot mount arbitrary filesystem images by default. Consequently, the potential for an unprivileged local denial of service is minimal in typical production setups.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.