CVE-2026-46078

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46078", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.096Z", "datePublished": "2026-05-27T12:58:11.916Z", "dateUpdated": "2026-10-19T19:26:43.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:31.009Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\n\nCurrently we already have boundary-checks for nameoffs, but the trailing\ndirents are special since the namelens are calculated with strnlen()\nwith unchecked nameoffs.\n\nIf a crafted EROFS has a trailing dirent with nameoff >= maxsize,\nmaxsize - nameoff can underflow, causing strnlen() to read past the\ndirectory block.\n\nnameoff0 should also be verified to be a multiple of\n`sizeof(struct erofs_dirent)` as well [1].\n\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is triggered by parsing a maliciously crafted EROFS filesystem image during a directory read; the data is processed locally after the image is presented (file/loop/removable media), with no network reachability for the readdir path.\nAC:L - An attacker fully controls the on-disk `nameoff` field of the trailing dirent in the crafted image, so the unsigned underflow and resulting out-of-bounds `strnlen` are reproduced deterministically every time the directory is read.\nPR:N - Once the crafted image is mounted, triggering the bug requires only an ordinary directory listing (getdents/readdir), which needs no special privileges; this matches the sibling crafted-image EROFS CVE-2026-43166.\nUI:R - EROFS lacks FS_USERNS_MOUNT and requires CAP_SYS_ADMIN to mount, so a separate user/automounter must mount the attacker-supplied image before the vulnerable readdir path can execute.\nS:U - The out-of-bounds access stays within the kernel's own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed length drives an unbounded `strnlen` that reads kernel memory far past the directory-block buffer; per the OOB-read guidance this unbounded read is High.\nI:N - The defect is strictly a read (strnlen over adjacent memory); no out-of-bounds write, use-after-free, or type confusion occurs, so no data can be modified.\nA:H - Scanning up to ~4 GB past the buffer readily walks into unmapped memory, producing a kernel oops/panic and denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/dir.c"], "versions": [{"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "a8ee527807f7d97e55ce2ef2906f7f34975eb1c7", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "aa16dca1b062355181ef215229eeac249d7c0d61", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "80a23c6d1aba35be8746d74ac14e6ba5ae46da21", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "222055e6b4063abd2d9e13c3d49bbd1724c50789", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "48b27a955d22391c7f30169fa7b6b2e1977f1ce4", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "8ebb951a284b7446e025afc7dc5e9516ef9a7214", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "1d55445226c75ddd4e78b09b3e7d99109b28c366", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "d18a3b5d337fa412a38e776e6b4b857a58836575", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/dir.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.86", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.27", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7"}, {"url": "https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61"}, {"url": "https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21"}, {"url": "https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789"}, {"url": "https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4"}, {"url": "https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214"}, {"url": "https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366"}, {"url": "https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575"}], "title": "erofs: fix the out-of-bounds nameoff handling for trailing dirents", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:29.931334Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:26:43.106Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46078", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.096Z", "datePublished": "2026-05-27T12:58:11.916Z", "dateUpdated": "2026-10-19T19:26:43.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:31.009Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\n\nCurrently we already have boundary-checks for nameoffs, but the trailing\ndirents are special since the namelens are calculated with strnlen()\nwith unchecked nameoffs.\n\nIf a crafted EROFS has a trailing dirent with nameoff >= maxsize,\nmaxsize - nameoff can underflow, causing strnlen() to read past the\ndirectory block.\n\nnameoff0 should also be verified to be a multiple of\n`sizeof(struct erofs_dirent)` as well [1].\n\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is triggered by parsing a maliciously crafted EROFS filesystem image during a directory read; the data is processed locally after the image is presented (file/loop/removable media), with no network reachability for the readdir path.\nAC:L - An attacker fully controls the on-disk `nameoff` field of the trailing dirent in the crafted image, so the unsigned underflow and resulting out-of-bounds `strnlen` are reproduced deterministically every time the directory is read.\nPR:N - Once the crafted image is mounted, triggering the bug requires only an ordinary directory listing (getdents/readdir), which needs no special privileges; this matches the sibling crafted-image EROFS CVE-2026-43166.\nUI:R - EROFS lacks FS_USERNS_MOUNT and requires CAP_SYS_ADMIN to mount, so a separate user/automounter must mount the attacker-supplied image before the vulnerable readdir path can execute.\nS:U - The out-of-bounds access stays within the kernel's own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed length drives an unbounded `strnlen` that reads kernel memory far past the directory-block buffer; per the OOB-read guidance this unbounded read is High.\nI:N - The defect is strictly a read (strnlen over adjacent memory); no out-of-bounds write, use-after-free, or type confusion occurs, so no data can be modified.\nA:H - Scanning up to ~4 GB past the buffer readily walks into unmapped memory, producing a kernel oops/panic and denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/dir.c"], "versions": [{"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "a8ee527807f7d97e55ce2ef2906f7f34975eb1c7", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "aa16dca1b062355181ef215229eeac249d7c0d61", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "80a23c6d1aba35be8746d74ac14e6ba5ae46da21", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "222055e6b4063abd2d9e13c3d49bbd1724c50789", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "48b27a955d22391c7f30169fa7b6b2e1977f1ce4", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "8ebb951a284b7446e025afc7dc5e9516ef9a7214", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "1d55445226c75ddd4e78b09b3e7d99109b28c366", "status": "affected", "versionType": "git"}, {"version": "3aa8ec716e52c02360457fa018296629b4d0becf", "lessThan": "d18a3b5d337fa412a38e776e6b4b857a58836575", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/dir.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.86", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.27", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7"}, {"url": "https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61"}, {"url": "https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21"}, {"url": "https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789"}, {"url": "https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4"}, {"url": "https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214"}, {"url": "https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366"}, {"url": "https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575"}], "title": "erofs: fix the out-of-bounds nameoff handling for trailing dirents", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:29.931334Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:19:30.531Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/erofs/dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a8ee527807f7d97e55ce2ef2906f7f34975eb1c7", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "aa16dca1b062355181ef215229eeac249d7c0d61", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "80a23c6d1aba35be8746d74ac14e6ba5ae46da21", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "222055e6b4063abd2d9e13c3d49bbd1724c50789", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "48b27a955d22391c7f30169fa7b6b2e1977f1ce4", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "8ebb951a284b7446e025afc7dc5e9516ef9a7214", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "1d55445226c75ddd4e78b09b3e7d99109b28c366", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}, {"lessThan": "d18a3b5d337fa412a38e776e6b4b857a58836575", "status": "affected", "version": "3aa8ec716e52c02360457fa018296629b4d0becf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/erofs/dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.86", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.27", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "371269AD-0F41-4AA3-A04C-8560F4185F8B", "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\n\nCurrently we already have boundary-checks for nameoffs, but the trailing\ndirents are special since the namelens are calculated with strnlen()\nwith unchecked nameoffs.\n\nIf a crafted EROFS has a trailing dirent with nameoff >= maxsize,\nmaxsize - nameoff can underflow, causing strnlen() to read past the\ndirectory block.\n\nnameoff0 should also be verified to be a multiple of\n`sizeof(struct erofs_dirent)` as well [1].\n\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com"}], "id": "CVE-2026-46078", "lastModified": "2026-10-19T20:18:28.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46078", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:19:29.931334Z", "version": "2.0.3"}}]}, "published": "2026-05-27T14:17:29.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: erofs: fix the out-of-bounds nameoff handling for trailing dirents", "id": "2482136", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482136"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's EROFS filesystem. A local attacker could exploit an out-of-bounds read vulnerability by creating a specially crafted EROFS image. This issue arises from incorrect calculations of directory entry name lengths, which can cause the system to read beyond allocated memory. Successful exploitation could lead to information disclosure or a system crash (denial of service)."], "name": "CVE-2026-46078", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46078\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46078\nhttps://lore.kernel.org/linux-cve-announce/2026052700-CVE-2026-46078-dc1f@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3aa8ec716e52c02360457fa018296629b4d0becf,222055e6b4063abd2d9e13c3d49bbd1724c50789)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3aa8ec716e52c02360457fa018296629b4d0becf,48b27a955d22391c7f30169fa7b6b2e1977f1ce4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3aa8ec716e52c02360457fa018296629b4d0becf,8ebb951a284b7446e025afc7dc5e9516ef9a7214)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3aa8ec716e52c02360457fa018296629b4d0becf,1d55445226c75ddd4e78b09b3e7d99109b28c366)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3aa8ec716e52c02360457fa018296629b4d0becf,d18a3b5d337fa412a38e776e6b4b857a58836575)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.86,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.27,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.4,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-27T18:15:21.492803+00:00", "updated": "2026-08-12T04:15:07.014110+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}