EUVD-2026-38883
GHSA-v64f-8vqx-f88g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local access and low privileges suffice to trigger the truncation via EROFS access; no confidentiality or integrity impact, only availability loss through potential kernel crash.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
erofs: unify lcn as u64 for 32-bit platforms
As sashiko reported [1], lcn was typed as unsigned long (or unsigned int sometimes), which is only 32 bits wide on 32-bit platforms, which causes (lcn << lclusterbits) to be truncated at 4 GiB.
In order to consolidate the logic, just use u64 consistently around the codebase.
[1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com
AnalysisAI
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where unsigned long is 32 bits wide) with EROFS filesystems mounted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions simultaneously: (1) the host kernel must be running on a 32-bit architecture (i386, ARM32, MIPS32, etc.) where `unsigned long` is 32 bits wide - 64-bit systems are categorically unaffected; (2) an EROFS filesystem must be mounted and accessible to the local attacker; (3) the filesystem image must contain files or metadata whose logical cluster numbers, when shifted by `lclusterbits`, produce an offset exceeding 4 GiB (2^32 bytes). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) accurately reflects the constrained attack surface: exploitation is strictly local, requires only low privileges, and yields no confidentiality or integrity impact - only availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a 32-bit Linux system (e.g., an i386 or ARM32 device) mounts or accesses an EROFS filesystem image that contains data or metadata whose logical cluster number translates to a byte offset exceeding 4 GiB. The truncated LCN causes the kernel to compute an incorrect block address, potentially triggering a kernel BUG, NULL dereference, or similar fatal condition that crashes the system. … |
| Remediation | The primary fix is to upgrade to a patched stable kernel release: 6.12.91, 6.18.33, 7.0.10, or 7.1, all of which contain the `u64` unification commits available at https://git.kernel.org/stable/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today