CVE-2026-46078
Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs. If a crafted EROFS has a trailing dirent with nameoff >= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block. nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1]. [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com
How to fix
- linux linux_kernel5.10.259, 5.15.210, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.19 ≤ v < 5.10.259, 5.11 ≤ v < 5.15.210, 5.16 ≤ v < 6.1.175, 6.2 ≤ v < 6.6.140, 6.7 ≤ v < 6.12.86, 6.13 ≤ v < 6.18.27, 6.19 ≤ v < 7.0.4 | 5.10.259, 5.15.210, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.