CVE-2026-43166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43166", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.990Z", "datePublished": "2026-05-06T11:27:43.242Z", "dateUpdated": "2026-08-05T12:26:16.817Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:16.817Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced plain identification for encoded extents\n\nOnly plain data whose start position and on-disk physical length are\nboth aligned to the block size should be classified as interlaced\nplain extents. Otherwise, it must be treated as shifted plain extents.\n\nThis issue was found by syzbot using a crafted compressed image\ncontaining plain extents with unaligned physical lengths, which can\ncause OOB read in z_erofs_transform_plain()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached by local VFS operations on a crafted EROFS image: mount the image and read/open a compressed file so EROFS performs readahead/decompression. There is no direct network, adjacent, or physical protocol entry point in EROFS itself.\nAC:L - The trigger is deterministic malformed extent metadata with an aligned physical start and unaligned encoded length; syzbot reproduced it with a crafted image and ordinary mount/open/read activity. No attacker-uncontrolled race or fragile timing condition is required.\nPR:N - An attacker can craft and supply the malicious EROFS image without privileges; the privileged filesystem mount/read can be performed by an interacting victim or image-processing environment. EROFS is not marked FS_USERNS_MOUNT, so a purely self-triggered local mount would require CAP_SYS_ADMIN, but the higher-severity defensible scenario is malicious media/image handling.\nUI:R - Exploitation requires some user or system action to mount or otherwise process the crafted EROFS image and read/open the affected file. The vulnerable code is not reached passively before the image is mounted/read.\nS:U - The bug is in kernel filesystem parsing/decompression and affects the same kernel security authority. It does not cross a hypervisor, VM, IOMMU, or sandbox boundary by itself.\nC:H - The bug causes a slab/out-of-bounds read of up to a page-sized copy in z_erofs_transform_plain(), and the copied bytes are placed into output/page-cache data readable through the file path. This can disclose kernel memory and is not limited to a few fixed bytes.\nI:N - The faulty operation is an out-of-bounds read from the input page mapping followed by copying into the file output page; it does not write out of bounds or corrupt kernel control data. No direct integrity modification primitive is evident.\nA:H - syzbot demonstrated a KASAN slab-out-of-bounds/use-after-free read in this path, and such kernel memory-safety faults can produce an oops/panic on hardened or faulting configurations. The crafted image can retrigger the fault through repeated reads."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/zmap.c"], "versions": [{"version": "1d191b4ca51d73699cb127386b95ac152af2b930", "lessThan": "9d5a97bc71ed5783687705c708454c4453aa91d1", "status": "affected", "versionType": "git"}, {"version": "1d191b4ca51d73699cb127386b95ac152af2b930", "lessThan": "d3790f26d38606f020212486359b84632c19d08b", "status": "affected", "versionType": "git"}, {"version": "1d191b4ca51d73699cb127386b95ac152af2b930", "lessThan": "4a2d046e4b13202a6301a993961f5b30ae4d7119", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/zmap.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9d5a97bc71ed5783687705c708454c4453aa91d1"}, {"url": "https://git.kernel.org/stable/c/d3790f26d38606f020212486359b84632c19d08b"}, {"url": "https://git.kernel.org/stable/c/4a2d046e4b13202a6301a993961f5b30ae4d7119"}], "title": "erofs: fix interlaced plain identification for encoded extents", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/erofs/zmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9d5a97bc71ed5783687705c708454c4453aa91d1", "status": "affected", "version": "1d191b4ca51d73699cb127386b95ac152af2b930", "versionType": "git"}, {"lessThan": "d3790f26d38606f020212486359b84632c19d08b", "status": "affected", "version": "1d191b4ca51d73699cb127386b95ac152af2b930", "versionType": "git"}, {"lessThan": "4a2d046e4b13202a6301a993961f5b30ae4d7119", "status": "affected", "version": "1d191b4ca51d73699cb127386b95ac152af2b930", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/erofs/zmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced plain identification for encoded extents\n\nOnly plain data whose start position and on-disk physical length are\nboth aligned to the block size should be classified as interlaced\nplain extents. Otherwise, it must be treated as shifted plain extents.\n\nThis issue was found by syzbot using a crafted compressed image\ncontaining plain extents with unaligned physical lengths, which can\ncause OOB read in z_erofs_transform_plain()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: soluci\u00f3n para la identificaci\u00f3n de datos planos entrelazados en extensiones codificadas\n\nSolo los datos planos cuya posici\u00f3n de inicio y longitud f\u00edsica en disco est\u00e9n ambas alineadas al tama\u00f1o de bloque deben clasificarse como extensiones planas entrelazadas. De lo contrario, debe tratarse como extensiones planas desplazadas.\n\nEste problema fue descubierto por syzbot utilizando una imagen comprimida manipulada que conten\u00eda extensiones planas con longitudes f\u00edsicas no alineadas, lo que puede causar una lectura OOB en z_erofs_transform_plain()."}], "id": "CVE-2026-43166", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-06T12:16:34.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4a2d046e4b13202a6301a993961f5b30ae4d7119"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9d5a97bc71ed5783687705c708454c4453aa91d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d3790f26d38606f020212486359b84632c19d08b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: erofs: fix interlaced plain identification for encoded extents", "id": "2467137", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467137"}, "csaw": false, "cwe": "CWE-1284", "details": ["A flaw was found in the Linux kernel's erofs filesystem. This vulnerability allows an attacker to trigger an out-of-bounds (OOB) read by providing a specially crafted compressed image. The flaw occurs due to incorrect identification of interlaced plain extents when their start position or on-disk physical length is not aligned to the block size. A successful exploit could lead to information disclosure or a denial of service."], "name": "CVE-2026-43166", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43166\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43166\nhttps://lore.kernel.org/linux-cve-announce/2026050633-CVE-2026-43166-b297@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d191b4ca51d73699cb127386b95ac152af2b930,9d5a97bc71ed5783687705c708454c4453aa91d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d191b4ca51d73699cb127386b95ac152af2b930,d3790f26d38606f020212486359b84632c19d08b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d191b4ca51d73699cb127386b95ac152af2b930,4a2d046e4b13202a6301a993961f5b30ae4d7119)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:45:07.018435+00:00", "updated": "2026-05-14T00:15:07.634190+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}