CVE-2026-98067

A flaw was found in the Linux kernel's EROFS (Enhanced Read-Only File System). The rolling decompression mechanism used for LZ4-compressed files assumes that data is always copied forward in memory. On certain system architectures, the underlying memory copy operation can copy backward, invalidating the rolling buffer and corrupting the decompressed output. A local user reading compressed data from an EROFS file system can trigger this flaw, leading to data corruption and the retrieval of incorrect information.

A low impact flaw was found in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The EROFS LZ4 rolling decompression optimization assumes that LZ4 literal-copy operations always copy data forward in memory. On some architectures, such as x86, the underlying memmove() implementation can copy long literals backward even when the source and destination ranges do not overlap, which breaks the rolling-window assumption and can corrupt the decompressed output. A local user reading LZ4-compressed data from a mounted EROFS filesystem can trigger this flaw, resulting in data corruption and the retrieval of incorrect information. Red Hat Enterprise Linux 6, 7, 8, and 9 and the OpenShift RHEL CoreOS images are not affected because the vulnerable EROFS LZ4 rolling decompression code is not present in those kernels. While the CVSS 3.1 base score of 5.5 corresponds to moderate severity, Red Hat assesses the overall impact of this flaw as low because it is not remotely exploitable: triggering it requires local access to a system with a mounted EROFS filesystem that uses LZ4 compression, and the consequence is limited to the integrity of the data read from such a filesystem. The upstream fix disables the LZ4 rolling decompression optimization to ensure data correctness, at the cost of a higher runtime memory footprint during decompression. Fixes for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams are currently deferred. The residual risk is limited to potential corruption of data read from LZ4-compressed EROFS filesystems on affected systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.