erofs: fix the out-of-bounds nameoff handling for trailing dirents
At a glance
Severity
HIGH 7.1
EPSS
EPSS 0.13 % · percentile 3 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Undergoing Analysis
Description
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix the out-of-bounds nameoff handling for trailing dirents
Currently we already have boundary-checks for nameoffs, but the trailing
dirents are special since the namelens are calculated with strnlen()
with unchecked nameoffs.
If a crafted EROFS has a trailing dirent with nameoff >= maxsize,
maxsize - nameoff can underflow, causing strnlen() to read past the
directory block.
nameoff0 should also be verified to be a multiple of
`sizeof(struct erofs_dirent)` as well [1].
[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com
