CVE-2026-43166
erofs Interlaced Plain Extent Identification Vulnerability
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux_kernel | erofs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's erofs file system implementation. It involves incorrect classification of certain plain data extents when their start position and physical length on disk are not aligned to the block size. Specifically, plain data with unaligned physical lengths was mistakenly treated as interlaced plain extents instead of shifted plain extents. This misclassification can lead to an out-of-bounds (OOB) read error in the function z_erofs_transform_plain().
How can this vulnerability impact me? :
The vulnerability can cause an out-of-bounds read in the Linux kernel when processing specially crafted compressed images containing unaligned plain extents. This could potentially lead to system instability, crashes, or exposure of unintended memory contents, depending on how the kernel handles the OOB read.