Skip to main content

Linux Kernel EUVDEUVD-2026-27741

| CVE-2026-43179 MEDIUM
2026-05-06 Linux GHSA-43g9-xc7g-7r65
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local mount access with low privilege suffices to trigger the leak; only availability is impacted via memory exhaustion, no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:07 vuln.today
CVSS changed
May 12, 2026 - 19:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix incorrect early exits for invalid metabox-enabled images

Crafted EROFS images with metadata compression enabled can trigger incorrect early returns, leading to folio reference leaks.

However, this does not cause system crashes or other severe issues.

AnalysisAI

EROFS filesystem folio reference leaks in the Linux kernel allow a local low-privileged attacker to cause availability degradation by mounting crafted EROFS images with metabox (metadata compression) enabled, triggering incorrect early returns in the kernel's EROFS parser. Affected kernels prior to stable releases 6.18.16, 6.19.6, and 7.0 are vulnerable; the vendor explicitly notes no system crashes result, limiting impact to gradual resource exhaustion. No public exploit code exists and EPSS sits at 0.02% (4th percentile), indicating negligible observed exploitation interest at time of analysis.

Technical ContextAI

EROFS (Enhanced Read-Only File System) is a Linux kernel filesystem driver optimized for read-only use cases, widely used in Android system images and embedded distributions. The 'metabox' feature refers to EROFS metadata compression, introduced to reduce on-disk overhead for metadata blocks. The vulnerability lies in the error-handling logic within the EROFS image parser: when processing a crafted image that triggers specific validation failures, the code performs incorrect early returns without properly releasing folio references. Folios are the Linux kernel's abstraction over page cache entries (introduced as a generalization of struct page). Leaked folio references prevent the memory subsystem from reclaiming those pages, causing a slow memory leak. The CPE cpe:2.3:a:linux:linux identifies the Linux kernel as the affected product. While no CWE is formally assigned, the root cause is consistent with CWE-459 (Incomplete Cleanup) or CWE-772 (Missing Release of Resource after Effective Lifetime).

RemediationAI

The primary fix is upgrading to a patched Linux kernel stable release: 6.18.16, 6.19.6, or Linux 7.0, depending on the branch in use. Upstream fix commits are available at https://git.kernel.org/stable/c/643575d5a4f24b23b0c54aa20aa74a4abed8ff5e, https://git.kernel.org/stable/c/041b5163bb9b2e81050bcd885b3373bf2f42d5f5, and https://git.kernel.org/stable/c/56e4a84220045b6af0f1efc11825b39217c7decf. Red Hat and SUSE users should monitor their respective vendor advisories for backported kernel packages. As a compensating control where immediate patching is not feasible, restricting the ability of unprivileged users to mount EROFS images (e.g., disabling unprivileged user namespaces via 'sysctl -w kernel.unprivileged_userns_clone=0' on applicable distributions, or enforcing mount restrictions via AppArmor/SELinux policy) will prevent exploitation - note this may break container runtimes relying on user namespaces. If EROFS is not used in the environment and is compiled as a module, unloading or blacklisting the 'erofs' kernel module ('echo erofs >> /etc/modprobe.d/blacklist.conf') eliminates the attack surface with no functional side effects for non-EROFS workloads.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27741 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy