In the Linux kernel, the following vulnerability has been resolved:
erofs: fix interlaced plain identification for encoded extents
Only plain data whose start position and on-disk physical length are
both aligned to the block size should be classified as interlaced
plain extents. Otherwise, it must be treated as shifted plain extents.
This issue was found by syzbot using a crafted compressed image
containing plain extents with unaligned physical lengths, which can
cause OOB read in z_erofs_transform_plain().
References
Configurations
Configuration 1 (hide)
|
History
13 May 2026, 21:18
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/4a2d046e4b13202a6301a993961f5b30ae4d7119 - Patch | |
| References | () https://git.kernel.org/stable/c/9d5a97bc71ed5783687705c708454c4453aa91d1 - Patch | |
| References | () https://git.kernel.org/stable/c/d3790f26d38606f020212486359b84632c19d08b - Patch | |
| First Time |
Linux linux Kernel
Linux |
08 May 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
06 May 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-06 12:16
Updated : 2026-05-13 21:18
NVD link : CVE-2026-43166
Mitre link : CVE-2026-43166
CVE.ORG link : CVE-2026-43166
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write