CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's EROFS filesystem driver, specifically in how it handles nameoff values for trailing directory entries. The flaw is reached locally and requires a user to interact with a crafted EROFS image, meaning no network access is needed but victim interaction is required. Successful exploitation allows an attacker to read memory past the directory block boundary, disclosing sensitive kernel memory contents, and can also disrupt service availability. A patched-image rebuild at the fix versions is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No account or credentials are required to trigger the vulnerability; any unprivileged user who can mount or access the crafted EROFS image can exploit it.

• Victim interactionRequired

  A user must interact with a crafted EROFS filesystem image, for example by mounting or browsing it, making this a social-engineering vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other environmental factors once the crafted image is in place.

Blast Radius

• Reads kernel memory past the directory block boundary, which may expose sensitive in-memory data such as kernel heap contents, stack values, or data belonging to other processes.
• Causes an out-of-bounds memory read that can trigger a kernel panic or BUG, crashing the affected system or container and disrupting all workloads running on that host.