erofs: fix interlaced ztailpacking pclusters
In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.191, 6.12.114, 6.18.52, 6.6.160, 7.2.6
- CVEs
- CVE-2026-90161
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 06:14 UTC · Revision 1
Source evidence
erofs: fix interlaced ztailpacking pclusters
core-osv · Original sourcePublished 17 Sept 2026, 16:06 UTC
In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.
osv:CVE-2026-90161
Kernel
Fixed versions: 6.1.191, 6.6.160, 6.12.114, 6.18.52, 7.2.6
Complete source record
{
"id": "d85c368e2c1322fbb0b50e53e321cfa46449bbf636376c58290b30009bc8d3d9",
"url": "https://osv.dev/vulnerability/CVE-2026-90161",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "erofs: fix interlaced ztailpacking pclusters",
"summary": "In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.",
"evidence": "osv:CVE-2026-90161",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.191",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.160",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.114",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.52",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-90161",
"aliases": [
"CVE-2026-90161"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fdffc091e6f94602558bba712b51bc16f79fd6d5"
},
{
"fixed": "b634286a8628155557a4f473a9dbab18bb439a7b"
},
{
"fixed": "795dca34a41545d377d19bc492b10bc789772410"
},
{
"fixed": "cd59f91cbc1e715cb5dc65773ee22123d70cb8f2"
},
{
"fixed": "ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"
},
{
"fixed": "451027c642e752420e1a04237db9ce7b35cee595"
},
{
"fixed": "862427ebb81d1f6abbf74d799790e1694b37b187"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.0.16"
},
{
"fixed": "6.1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7d6ef8277e44c22f894d54d26ddb36c22d60712d"
}
]
}
],
"versions": [
"v6.0.19",
"v6.0.18",
"v6.0.17",
"v6.0.16"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90161.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.1.191"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.160"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.114"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.52"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90161.json"
}
}
],
"modified": "2026-11-01T02:30:22.405026961Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595",
"https://git.kernel.org/stable/c/795dca34a41545d377d19bc492b10bc789772410",
"https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187",
"https://git.kernel.org/stable/c/b634286a8628155557a4f473a9dbab18bb439a7b",
"https://git.kernel.org/stable/c/cd59f91cbc1e715cb5dc65773ee22123d70cb8f2",
"https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90161.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-90161",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90161.json"
}
},
"related_cves": [
{
"value": "CVE-2026-90161",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493005,
"published_at": "2026-09-17T16:06:52.47+00:00"
}