VulnerabilityPublished 4 Sep 2026Updated 6 Nov 2026

CVE-2026-80892: Linux kernel · erofs: cap LZMA stream pool size

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in e52da169b8c0d19bb2d803f2a07fe0e5a00462d6 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in e52da169b8c0d19bb2d803f2a07fe0e5a00462d6, e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4, c9b47e6b23114e939b17f818471c7a46e59006e7 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 622ceaddb7649ca328832f50ba1400af778d75fa, < e52da169b8c0d19bb2d803f2a07fe0e5a00462d6	Fixed in e52da169b8c0d19bb2d803f2a07fe0e5a00462d6
LinuxLinux	Affected ≥ 622ceaddb7649ca328832f50ba1400af778d75fa, < e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4	Fixed in e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4
LinuxLinux	Affected ≥ 622ceaddb7649ca328832f50ba1400af778d75fa, < c9b47e6b23114e939b17f818471c7a46e59006e7	Fixed in c9b47e6b23114e939b17f818471c7a46e59006e7
LinuxLinux	Affected ≥ 622ceaddb7649ca328832f50ba1400af778d75fa, < 682cb3ece37fc5141e73bc726ccf4adb833e5189	Fixed in 682cb3ece37fc5141e73bc726ccf4adb833e5189
LinuxLinux	Affected ≥ 622ceaddb7649ca328832f50ba1400af778d75fa, < 5aaa06dfc10f8398c8807453dbec738ea9af10e4	Fixed in 5aaa06dfc10f8398c8807453dbec738ea9af10e4
LinuxLinux	Affected ≥ 622ceaddb7649ca328832f50ba1400af778d75fa, < 0c676903cb2a61992ded8e7907609cc6b0f11744	Fixed in 0c676903cb2a61992ded8e7907609cc6b0f11744

AI-suggested

A fix is available in the Linux kernel as indicated by the fixed commit versions. Systems running affected versions should upgrade to a fixed kernel version containing the CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option or later. Administrators who explicitly set the lzma_streams module parameter are not affected by this change. No additional action is required beyond applying the official fix.

Description

A vulnerability in the Linux kernel's EROFS filesystem module allows excessive memory allocation for LZMA decompression streams. The module previously sized the LZMA stream pool based on the number of CPUs without an upper bound, potentially causing large vmalloc memory usage on high-CPU systems. This could lead to hundreds of megabytes of memory being pinned until the module is unloaded. The issue is addressed by introducing a configurable maximum stream count defaulting to 16, limiting worst-case memory preallocation to 128 MiB on systems with 16 or more CPUs.

Impact

An EROFS image mounted on a system with many CPUs could cause the kernel to pin large amounts of vmalloc memory (up to 8 MiB per LZMA stream) unexpectedly or as intended, potentially leading to resource exhaustion or degraded system performance until the erofs module is unloaded.

Summary

The Linux kernel's EROFS filesystem module had a vulnerability where the LZMA decompressor stream pool size was determined by num_possible_cpus() when the lzma_streams parameter was unset. Each stream preallocates an image-supplied dictionary up to 8 MiB, which on high-CPU systems could cause excessive vmalloc memory usage. This could result in a small EROFS image pinning hundreds of megabytes of memory until the erofs module is unloaded. The fix introduces a new kernel configuration option CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS, defaulting to 16, bounding the default stream count and thus limiting memory usage. The explicit lzma_streams module parameter remains honored for administrators who want to size the pool manually.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:33 UTC

Technical details

References

Community reviews

Related threats