Linux Kernel CVE-2026-90161

Requires the EROFS (Enhanced Read-Only File System) driver to be built/loaded, and the attacker must supply a hand-crafted EROFS image containing an invalid interlaced ztailpacking pcluster whose on-disk size is not block-aligned - a combination mkfs.erofs never produces, so only deliberately malicious images trigger it. Exploitation further requires the victim to mount that image and read the crafted file (UI:R); mounting an untrusted filesystem image typically needs CAP_SYS_ADMIN or an automount/removable-media pathway. It is local only (AV:L) - no remote or network trigger - which substantially limits real-world reach despite the memory-disclosure impact.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 7.1) frames this as a local, low-complexity flaw requiring user interaction. The interaction is the decisive limiter: an attacker cannot trigger the out-of-bounds read remotely - a victim must mount (or otherwise process) a maliciously crafted EROFS image. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided intelligence, so all real-risk signals are 'no public exploit identified at time of analysis.' The description itself notes that mkfs.erofs never generates the offending interlaced ztailpacking pcluster, so no legitimate filesystem is affected - exploitation is entirely dependent on an attacker delivering a hand-crafted image. The primary impact is confidentiality (C:H: kernel memory copied into userspace-visible page cache); the vendor's A:H (crash/DoS) is plausible but optimistic since an OOB read does not always fault. This is a real but low-priority patch: genuine memory-disclosure primitive, but gated behind crafted-image delivery and a mount action, and not under active exploitation. The 'Buffer Overflow' tag is imprecise - this is an out-of-bounds READ (CWE-125), not a write overflow; the CWE field is N/A in the input and should be treated as unconfirmed.

An attacker crafts an EROFS filesystem image containing an invalid interlaced ztailpacking pcluster with a non-block-aligned on-disk size, then delivers it to a victim (e.g., a USB stick, downloaded container/system image, or automount-triggered media). When the victim mounts the image and reads the malicious file, the decompressor performs an out-of-bounds read from a kmap'd page, copying unrelated kernel memory into the userspace-visible page cache where the attacker's process can read it. No public proof-of-concept is identified in the available intelligence.