The vulnerability in the Linux kernel's erofs filesystem concerns the resizing logic of global buffers tracked by z_erofs_gbuf_nrpages. When resizing buffers, if some buffers are enlarged but a resize attempt fails, retrying the resize can revisit already enlarged buffers. Retrying the same size leads to an -ENOMEM error due to alloc_pages_bulk() having no pages to allocate, which is incorrectly treated as failure. Retrying with an intermediate size causes allocation of a temporary pointer array smaller than the number of pages, resulting in copying more pointers than the array can hold. The fix involves skipping buffers that already meet the size requirement and advancing z_erofs_gbuf_nrpages only after all buffers have caught up, ensuring safe resizing.

The vulnerability can cause memory allocation failures or buffer overflows during buffer resizing in the erofs filesystem, potentially leading to kernel instability or crashes. There is no indication of known exploitation in the wild or direct impact beyond memory management errors within the kernel module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.