Linux Kernel EUVD-2026-32227

Exploitation requires local access to read from an EROFS filesystem that contains ztailpacking pclusters (inline compressed data co-located with the tail of the compressed indexes). The crash is gated on a failure of read_mapping_folio() to fetch the inline data - the practical trigger described is a fatal signal arriving while that read is in progress (-EINTR/-4), making this a race condition rather than a deterministic call. Limiting factors: the attacker must be able to read such a specially-structured EROFS image, the timing window is narrow (the author notes it is 'somewhat hard to reproduce' because inline data normally arrives with the just-read index tail), CONFIG_EROFS must be present/active, and only low local privileges are needed (PR:L) with no user interaction. These constraints sharply reduce realistic exploitability below the raw CVSS figure.

Real-world priority is low-to-moderate despite the 7.1 CVSS. The given vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) marks it local, low-privilege, no user interaction. EPSS is 0.02% (5th percentile) and there is no KEV listing and no known POC, consistent with a hard-to-trigger local DoS rather than a remotely weaponizable bug. NOTE A CONFLICT: the vector asserts C:H (high confidentiality impact), but the described and back-traced behavior is a NULL pointer dereference causing a crash - an availability/DoS outcome - with no demonstrated information disclosure; the CWE-125 OOB-read classification may be the basis for C:H, but the evidence supports A:H far more than C:H. The author also states it is 'somewhat hard to reproduce,' requiring a race (a fatal signal arriving during read_mapping_folio()), which argues for higher attack complexity than the AC:L in the supplied vector. Treat this as a low-urgency stability/robustness fix to roll in with normal kernel patching unless EROFS is exposed to untrusted images or untrusted local users.

A local user repeatedly reads a file backed by an EROFS image that uses ztailpacking pclusters and delivers a fatal signal to the reading task to interrupt read_mapping_folio() at the right moment, causing inline-data acquisition to fail. Decompression then dereferences an unvalidated NULL folio pointer and panics the kernel, producing a denial of service. No public exploit code is identified, and reliable triggering depends on winning a timing race.