CVE-2026-89602erofs: skip sufficiently large global buffers when resizing
- 7.8HighCVSS base score
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the guaranteed minimum size across the pool.
Timeline
ID reserved
By Linux
Published
- 38 days later
· 38 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected d6db47e571dcaecaeaafa8840d00ae849ae3907b – < 3fbdd15d5830f52661eb78be95058d101cb0c2cb
- affected d6db47e571dcaecaeaafa8840d00ae849ae3907b – < 7267557ce98ccd07faaf3bc86382448950cc4ff6
- affected d6db47e571dcaecaeaafa8840d00ae849ae3907b – < 7f4a89d4f0d6acaf4b756c31de48f2109a257b70
- affected d6db47e571dcaecaeaafa8840d00ae849ae3907b – < a7d097cf01301c5da37927c8f26123d006f0fd8a
- affected 6.10
- unaffected < 6.10
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.51 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References4
- https://git.kernel.org/stable/c/3fbdd15d5830f52661eb78be95058d101cb0c2cb (opens in a new tab)
- https://git.kernel.org/stable/c/7267557ce98ccd07faaf3bc86382448950cc4ff6 (opens in a new tab)
- https://git.kernel.org/stable/c/7f4a89d4f0d6acaf4b756c31de48f2109a257b70 (opens in a new tab)
- https://git.kernel.org/stable/c/a7d097cf01301c5da37927c8f26123d006f0fd8a (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76514 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89602)Record last updated .