CVE-2026-64031

Analyzed Analyzed - Analysis Complete

Race Condition in EROFS Managed Cache for Unaligned Extents

Publication date: 2026-07-19

Last updated on: 2026-10-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: [Thread 1] [Thread 2] (z_erofs_fill_bio_vec) <handle a Z_EROFS_PREALLOCATED_FOLIO folio> ... filemap_add_folio (1) (z_erofs_bind_cache) <the same folio is found..> .. .. folio_attach_private (2) filemap_add_folio (3) again Since (1) is executed but (2) hasn't been executed yet, it's possible that another thread finds the same managed folio in z_erofs_bind_cache() for a different pcluster and calls filemap_add_folio() again since folio->private is still Z_EROFS_PREALLOCATED_FOLIO. Fix this by explicitly clearing folio->private before making the folio visible in the managed cache so that another pcluster can simply wait on the locked managed folio as what we did for other shared cases [1]. This only impacts unaligned data compression (`-E48bit` with zstd, for example). [1] Commit 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of crafted images properly") was originally introduced to handle crafted overlapped extents, but it addresses unaligned extents as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64031

EUVD

EUVD-2026-45604

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.15 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in the Linux kernel's erofs filesystem. It occurs when handling unaligned compressed data extents. Two threads may access the same memory folio simultaneously, where one thread is updating the folio while another tries to add it to the cache. This can lead to inconsistent state or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's erofs filesystem with unaligned compressed extents. Detection requires checking kernel version and erofs configuration. Use 'uname -a' to check kernel version and 'mount | grep erofs' to verify if erofs is mounted. If using zstd compression with -E48bit flag, inspect filesystem mount options.

Impact Analysis

If exploited, this could cause system instability, crashes, or data corruption on systems using the erofs filesystem with unaligned compressed data. It may lead to unexpected behavior or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a race condition in the Linux kernel's EROFS filesystem related to unaligned compressed extents, which could lead to data corruption or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for this race condition. If using erofs with unaligned compressed extents, avoid mounting with zstd compression and -E48bit flag until updated. Monitor system logs for filesystem errors indicating potential exploitation.

Hi! I’m here to help you understand CVE-2026-64031. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70