The vulnerability (CVE-2026-90161) in the Linux kernel's erofs filesystem involves improper handling of interlaced ztailpacking pclusters. On-disk sizes of these pclusters should be block-aligned, and ztailpacking interlaced pclusters should be considered invalid. Although the mkfs.erofs tool does not produce such pclusters, crafted images containing invalid interlaced ztailpacking pclusters can trigger an out-of-bounds read from a kmap'd page, leading to copying of irrelevant kernel memory into the userspace-visible page cache. This issue was fixed in the Linux kernel.

An attacker able to supply a crafted erofs filesystem image could cause an out-of-bounds read in kernel memory, potentially exposing sensitive kernel memory contents to userspace. The vulnerability does not affect existing valid filesystems, limiting exposure to crafted malicious images. The CVSS score is 7.1 (high), indicating a significant confidentiality impact and partial availability impact.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this fix. Since mkfs.erofs does not generate invalid interlaced ztailpacking pclusters, existing filesystems are not affected. No additional mitigation is required beyond applying the official kernel update.