CVE-2026-80892

Not scored yetLast modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: cap LZMA stream pool size

fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_erofs_load_lzma_config() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded.

Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly.

Bound the default stream count by a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzma_streams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 622ceaddb7649ca328832f50ba1400af778d75fa, < 682cb3ece37fc5141e73bc726ccf4adb833e5189; >= 622ceaddb7649ca328832f50ba1400af778d75fa, < e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4; >= 622ceaddb7649ca328832f50ba1400af778d75fa, < 0c676903cb2a61992ded8e7907609cc6b0f11744; >= 622ceaddb7649ca328832f50ba1400af778d75fa, < 5aaa06dfc10f8398c8807453dbec738ea9af10e4; >= 622ceaddb7649ca328832f50ba1400af778d75fa, < e52da169b8c0d19bb2d803f2a07fe0e5a00462d6; >= 622ceaddb7649ca328832f50ba1400af778d75fa, < c9b47e6b23114e939b17f818471c7a46e59006e7
LinuxLinux5.16

References

Timeline

Published
Sep 4, 2026
Last modified
Nov 6, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-80893In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() CVE-2026-80894In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replaCVE-2026-80895In the Linux kernel, the following vulnerability has been resolved: mshv: Order pt_vp_array publish against irqfd assertion path mshv_partCVE-2026-80896In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_deassign mshv_irqfd_deactivate() and the CVE-2026-80897In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator preparation failure netfs_CVE-2026-80898In the Linux kernel, the following vulnerability has been resolved: netfs: clear PG_private_2 on copy-to-cache append failure netfs_pgprivCVE-2026-80899In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introducCVE-2026-80907.3Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2CVE-2026-80900In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Make UMP message size check more robust If message offset CVE-2026-80901In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ip_vs_in_icmp_v6() is missing checkCVE-2026-80902In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA WhCVE-2026-80903In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xe_oa_emit_oa
CVE-2026-80892: Unscored | Vulnix