Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the… (CVE-2026-80892)

The Linux kernel's EROFS filesystem module had a vulnerability where the LZMA decompressor stream pool size was determined by the number of possible CPUs if the lzma_streams module parameter was unset. Each LZMA stream preallocates an image-supplied dictionary up to 8 MiB, which on high-CPU systems could result in hundreds of MiB of vmalloc memory being pinned by mounting a small EROFS image. This could lead to resource exhaustion or denial of service due to excessive memory consumption. The vulnerability was addressed by introducing a new kernel configuration option CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS, defaulting to 16 streams, capping the default memory preallocation to 128 MiB on systems with 16 or more CPUs. Explicit lzma_streams module parameters remain honored, so administrators who set this parameter are unaffected by the default cap.

An attacker or user mounting an EROFS image can cause the system to allocate and pin large amounts of vmalloc memory (up to 8 MiB per LZMA stream) based on the number of CPU cores, potentially leading to resource exhaustion or denial of service on high-CPU systems. This memory remains allocated until the erofs module is unloaded. The impact is primarily excessive memory consumption rather than code execution or data corruption.

A fix is available that introduces a kernel configuration option to limit the default number of LZMA streams to 16, thereby bounding memory preallocation. Administrators should ensure they are running a Linux kernel version that includes this fix. Systems with explicit lzma_streams module parameters are not affected by the default cap. If upgrading is not immediately possible, administrators can manually set the lzma_streams module parameter to a safe value to limit memory usage.