OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-90161

HIGH · CVSS 7.1 EPSS 0.18%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of interlaced ztailpacking pclusters, which can lead to out-of-bounds reads from kernel memory when crafted images are processed. This could potentially expose sensitive information by copying irrelevant kernel memory into user-visible page cache. Linux system administrators and developers working with file systems should prioritize this issue, especially if they handle untrusted or crafted filesystem images.

CVE
CVE-2026-90161
Severity
HIGH
CVSS
7.1
EPSS
0.18%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.