Linux Kernel CVE-2026-64146

Exploitation requires: (1) local system access with at minimum a low-privileged user account (PR:L per CVSS), (2) an erofs filesystem mounted on the target system with extended attributes (xattrs) enabled, and (3) the ability to access inodes whose xattr initialization triggers a specific error path after erofs_read_metabuf(). The vulnerability does not affect systems where erofs is not mounted, or where erofs filesystems carry no xattr data. Remote exploitation is not possible (AV:L). No user interaction by a privileged user is required (UI:N). The attack does not cross a privilege boundary (S:U), limiting impact to the local system's resource pool.

The CVSS 3.1 score of 5.5 (Medium) accurately reflects the constrained attack surface: AV:L requires local system access, PR:L requires at minimum a low-privileged user account, and S:U confirms no scope change into other system components. The availability impact (A:H) represents potential kernel resource exhaustion through accumulated unreleased folio references - meaningful only if an attacker can repeatedly trigger the error paths during xattr initialization. EPSS at 0.16% (6th percentile) strongly corroborates the assessment that exploitation is not occurring broadly in the wild. The vulnerability is absent from CISA KEV, and no POC has been identified. The 'Information Disclosure' tag present in the intelligence metadata conflicts with the CVSS vector's C:N rating; this discrepancy should be verified against the vendor fix commits, as the description and CVSS both indicate no confidentiality impact. Even a mid-sized municipal IT team in legnica should treat this as a routine patch-cycle item rather than an emergency response, unless erofs is actively mounted in production workloads. Systems using conventional Linux filesystems such as ext4, XFS, or btrfs are entirely unaffected.

A local user on a system with an erofs filesystem mounted triggers a specific error condition during extended attribute initialization - for example, by accessing an inode whose xattr header read fails mid-path - causing erofs_init_inode_xattrs() to exit via out_unlock without releasing the acquired metabuf folio reference. Repeated triggering of this path accumulates unreleased folio references, gradually exhausting kernel memory resources and potentially causing denial of service. No public exploit code has been identified at time of analysis.