CVE-2026-80892
Received Received - Intake

Memory Exhaustion in Linux Kernel EROFS LZMA Decompression

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_erofs_load_lzma_config() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded. Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly. Bound the default stream count by a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzma_streams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80892
EUVD
EUVD-2026-71642

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel From 16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper sizing of the LZMA stream pool in the EROFS filesystem. When the lzma_streams module parameter is not set, the system sizes the pool based on the number of CPUs. Each stream can then allocate up to 8 MiB of memory for dictionaries, potentially leading to excessive memory usage on high-CPU systems.

Detection Guidance

This vulnerability is specific to the Linux kernel's EROFS filesystem with LZMA decompression. Detection involves checking kernel version and EROFS module parameters. Use 'uname -a' to verify kernel version and 'lsmod | grep erofs' to check if the EROFS module is loaded. Monitor memory usage with 'vmallocinfo' or 'cat /proc/meminfo' for unusual vmalloc memory consumption.

Impact Analysis

An attacker could craft a small EROFS image that, when mounted, pins hundreds of MiB of vmalloc memory. This could lead to memory exhaustion, system slowdowns, or crashes on systems with many CPUs. The worst-case default preallocation is 128 MiB if the CPU count is 16 or more.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves memory allocation issues in the Linux kernel's EROFS filesystem, which could lead to resource exhaustion but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this CVE. If immediate updating is not possible, limit the number of LZMA streams by setting the 'lzma_streams' module parameter to a lower value. Monitor memory usage and unload the EROFS module if it is not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart