PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46078 Linux CVE debrief

A vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation allows out-of-bounds memory reads when processing crafted filesystem images. The issue affects trailing directory entries (dirents) where name offset (nameoff) values are not properly validated before use in strnlen() calculations. When a malicious EROFS image contains a trailing dirent with nameoff exceeding the maximum valid size, the subtraction maxsize - nameoff underflows, causing strnlen() to read beyond allocated directory block boundaries. Additionally, nameoff0 validation was missing alignment checks against sizeof(struct erofs_dirent). The vulnerability was resolved through kernel patches that add proper boundary verification and alignment checks for nameoff values in trailing dirent processing.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators, kernel maintainers, and security teams managing systems that mount EROFS filesystem images from external or untrusted sources

Technical summary

The EROFS filesystem driver in the Linux kernel failed to validate nameoff values for trailing directory entries before calculating name lengths with strnlen(). A crafted EROFS image with nameoff >= maxsize causes unsigned integer underflow in maxsize - nameoff, resulting in out-of-bounds memory reads. The fix adds boundary checks and verifies nameoff0 alignment to sizeof(struct erofs_dirent).

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available through distribution channels
  • Review systems mounting untrusted EROFS images and restrict such operations to isolated environments
  • Monitor vendor security advisories for kernel package updates addressing CVE-2026-46078
  • Validate EROFS image sources and integrity before mounting in production environments

Evidence notes

Vulnerability description confirms the issue is resolved in Linux kernel. Multiple stable kernel commits provided indicate backports to supported branches. No CVSS score or severity assigned by NVD at time of disclosure. No KEV listing present.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46078 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46078

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46078 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46078

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.