SB20260928135 - Expected behavior violation in Linux kernel erofs

Description

This security bulletin contains information about 1 vulnerability.

1) Expected behavior violation (CVE-ID: CVE-2026-98067)

CWE-ID: CWE-440 - Expected Behavior Violation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to an incorrect assumption about LZ4 literal copy direction in EROFS LZ4 rolling decompression when processing LZ4-compressed extents. A local user can trigger decompression of an LZ4-compressed extent to cause data corruption.

The issue can occur on x86 because the upstream LZ4 literal-copy memmove() may copy non-overlapping long literals backward.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7
• https://git.kernel.org/stable/c/c9a2db4b9950b59c571258e4bae74c271f62dd66
• https://git.kernel.org/stable/c/ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2