CVE-2026-46078 Details
Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs. If a crafted EROFS has a trailing dirent with nameoff >= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block. nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1]. [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com
A vulnerability has been identified in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation, specifically in the directory handling code. This vulnerability arises from improper boundary checks for directory entry names, which can lead to out-of-bounds memory access. The issue occurs when the name offset of a directory entry is calculated using an unchecked value, allowing a crafted EROFS image to exploit the flaw. If a trailing directory entry has a name offset greater than or equal to the maximum size, it can cause an underflow, leading the system to read past the intended directory block. The vulnerability affects several versions of the Linux kernel.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366 | kernel.org | Patch |
| https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789 | kernel.org | Patch |
| https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.19, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |