PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45943 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation, specifically affecting ztailpacking pclusters. The flaw occurs when compressed folios for ztailpacking pclusters are not validated before being added to I/O chains, causing z_erofs_decompress_pcluster() to dereference a NULL pointer. The vulnerability can be triggered when a fatal signal interrupts read_mapping_folio() during inline data read operations. The fix ensures inline data is read before allocating and adding pclusters to I/O chains.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with EROFS support, particularly those using compressed read-only filesystem images in container or embedded environments; security teams monitoring for local denial-of-service conditions; kernel maintainers tracking filesystem driver stability

Technical summary

The EROFS filesystem driver contains a race condition in ztailpacking pcluster handling where compressed folios may be assumed valid before actual validation occurs. When read_mapping_folio() is interrupted by a fatal signal, the inline data read fails with -EINTR (-4), but the pcluster is still added to I/O chains. Subsequent decompression attempts in z_erofs_decompress_queue() dereference NULL at offset 0x8, resulting in kernel panic. The fix reorders operations to ensure inline data availability before pcluster chain insertion.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches (5.15.y, 6.1.y, 6.6.y, 6.12.y) once available through distribution channels
  • Monitor distribution security advisories for backported fixes
  • Consider disabling EROFS if not required for system operation as temporary risk reduction
  • Review systems using EROFS with ztailpacking-enabled images for potential stability concerns
  • Implement kernel crash monitoring to detect potential exploitation attempts via NULL pointer dereference signatures

Evidence notes

Vulnerability confirmed via kernel commit messages and NVD entry. Multiple stable kernel branches received patches. No CVSS score assigned as of publication. Not listed in CISA KEV catalog.

Official resources

2026-05-27