CVE-2026-98067
Received Received - Intake

EROFS Kernel LZ4 Rolling Decompression Memory Issue

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression [1] was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent (pcluster), either due to random small read, or since uptodate folios (typically order-0) cannot be reused for decompression again since decompression algorithm refills already-uptodate folios. Rolling decompression works because LZ4 is LZ77-based and only refers to the most recent 64 KiB of decompressed data, so in theory only a bounded rolling window of temporary pages is needed when decompressing. It can save a lot of temporary memory, e.g. 601,960-byte data can be compressed into a 256k LZ4 compressed extent, which means it needs 146 extra pages per request in the worst case if rolling decompression is disabled. However, the upstream LZ4 implementation is not under EROFS' control: For example, the literal copy memmove() may still **copy long literals backward** on x86 based on the address comparison even when the source and destination ranges do not overlap (IOWs, inline decompression doesn't need to be considered here). That breaks the rolling assumption and makes the optimization broken. Disable it for now to make sure the data correctness first since EROFS is used everywhere now: The rolling window approach can be revived once we either ensure that the official LZ4 code always copies forward for non-overlapping ranges or maintain our own LZ4 implementation in EROFS. The main impact is a higher runtime memory footprint; However, recent commit 0f6273ab4637 ("erofs: add a reserved buffer pool for lz4 decompression") helps mitigate this when enabled but it's still not perfect. [1] https://www.usenix.org/conference/atc19/presentation/gao § 3.3 Decompression

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98067
EUVD
EUVD-2026-86720

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel erofs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a disabled LZ4 rolling decompression feature in the EROFS filesystem. The feature was designed to reduce memory usage during decompression by only keeping a 64 KiB rolling window of data. However, a flaw in the upstream LZ4 implementation can cause incorrect backward copying of data, breaking the rolling decompression assumption and risking data corruption. The feature has been disabled to prioritize data correctness.

Detection Guidance

This vulnerability is specific to the Linux kernel's EROFS filesystem and LZ4 decompression. Detection involves checking kernel logs for EROFS-related errors or verifying if rolling decompression is enabled. Commands like 'dmesg | grep erofs' or 'cat /proc/filesystems | grep erofs' may help identify affected systems.

Impact Analysis

The main impact is increased runtime memory usage during decompression operations. While a recent commit added a reserved buffer pool to help mitigate this, it may not fully resolve the issue. Users may experience higher memory consumption when reading compressed files, potentially affecting system performance.

Mitigation Strategies

Disable LZ4 rolling decompression in the kernel configuration or update to a patched kernel version. Enable the reserved buffer pool for LZ4 decompression if available. Monitor memory usage to ensure stability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart