CVE-2026-64031
Received Received - Intake

Race Condition in EROFS Managed Cache for Unaligned Extents

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: [Thread 1] [Thread 2] (z_erofs_fill_bio_vec) <handle a Z_EROFS_PREALLOCATED_FOLIO folio> ... filemap_add_folio (1) (z_erofs_bind_cache) <the same folio is found..> .. .. folio_attach_private (2) filemap_add_folio (3) again Since (1) is executed but (2) hasn't been executed yet, it's possible that another thread finds the same managed folio in z_erofs_bind_cache() for a different pcluster and calls filemap_add_folio() again since folio->private is still Z_EROFS_PREALLOCATED_FOLIO. Fix this by explicitly clearing folio->private before making the folio visible in the managed cache so that another pcluster can simply wait on the locked managed folio as what we did for other shared cases [1]. This only impacts unaligned data compression (`-E48bit` with zstd, for example). [1] Commit 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of crafted images properly") was originally introduced to handle crafted overlapped extents, but it addresses unaligned extents as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64031
EUVD
EUVD-2026-45604

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in the Linux kernel's erofs filesystem. It occurs when handling unaligned compressed data extents. Two threads may access the same memory folio simultaneously, where one thread is updating the folio while another tries to add it to the cache. This can lead to inconsistent state or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's erofs filesystem with unaligned compressed extents. Detection requires checking kernel version and erofs configuration. Use 'uname -a' to check kernel version and 'mount | grep erofs' to verify if erofs is mounted. If using zstd compression with -E48bit flag, inspect filesystem mount options.

Impact Analysis

If exploited, this could cause system instability, crashes, or data corruption on systems using the erofs filesystem with unaligned compressed data. It may lead to unexpected behavior or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a race condition in the Linux kernel's EROFS filesystem related to unaligned compressed extents, which could lead to data corruption or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for this race condition. If using erofs with unaligned compressed extents, avoid mounting with zstd compression and -E48bit flag until updated. Monitor system logs for filesystem errors indicating potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart