Linux Kernel CVE-2026-46329

Exploitation requires local access with at least low-level privilege (PR:L per CVSS) to a Linux system where an EROFS filesystem is mounted in file-backed mode - this is the critical, non-default configuration prerequisite. Standard block-device EROFS mounts are not affected per the vulnerability description. Exploitation is further limited by the requirement for local interactive or shell access (AV:L), making remote exploitation impossible. Environments that do not use file-backed EROFS mounts - including most traditional Linux server deployments - are not exposed. The attack is most relevant to Android build environments, container runtimes that unpack EROFS image layers into file-backed mounts, or embedded Linux systems using EROFS for rootfs images. No authentication bypass or network vector exists.

CVSS 3.1 scores this at 5.5 Medium with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local, low-complexity, low-privilege denial-of-service with no remote exploitation path. The EPSS score of 0.02% (5th percentile) confirms minimal real-world exploitation interest. KEV status is absent and no POC is known, indicating no observed threat actor activity. SSVC signals are unfavorable for urgency: exploitation is not automatable (requires local access and specific mount configuration), technical impact is partial (availability-only, within scope), and the flaw is not actively exploited. A meaningful discrepancy exists between the 'Information Disclosure' tag in the ENISA EUVD data and the CVSS C:N metric - if out-of-bounds kernel buffer contents are returned rather than zeroed, a confidentiality impact could be present and the true severity may be underrated; defenders should verify this with vendor errata. For most environments, this is a low-priority patch unless EROFS file-backed mounts are actively deployed, in which case local privilege escalation or container-escape scenarios may raise practical concern.

A local user with standard (low-privilege) access on a Linux system running a file-backed EROFS mount triggers or crafts I/O operations - for example, through a container runtime or direct filesystem operations - that reference offsets beyond the end of the underlying filesystem image. Because the kernel EROFS driver does not zero-fill these out-of-bounds requests as expected, the kernel encounters undefined state in the I/O completion path, potentially causing a kernel oops or panic and rendering the system unavailable. No public exploit code is known, and exploitation is constrained to systems with the specific file-backed EROFS mount configuration.