CVE-2026-97605

CVE CVE-2026-97605EUVD EUVD-2026-86736Published 2026-09-25T10:22:17.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: erofs: preserve LZMA decoders on resize failure The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is put back on the list with state == NULL. z_erofs_lzma_max_dictsize is still advanced as if the whole pool had been resized. An existing LZMA mount can select the broken stream and pass NULL to xz_dec_microlzma_reset(). A retry at the same size also skip another resize attempt. Since the global maximum was advanced, thus, the invalid state is left unrepaired. Allocate each replacement before freeing the old decoder, temporarily retaining one old decoder during allocation. Stop at the first failure and advance z_erofs_lzma_max_dictsize only after all streams satisfy the request. Record each stream's dictionary capacity so retries can skip streams already enlarged before a partial failure.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.12.111; patch: 7.3-rc3; patch: 7.2.7; 622ceaddb7649ca328832f50ba1400af778d75fa <38e9e07ac02a9453a117410776f1502a9980997e; 622ceaddb7649ca328832f50ba1400af778d75fa <617d0d8d199ba1790c94310fd75a22d01c97a8d6; patch: 0; patch: 6.18.53; 622ceaddb7649ca328832f50ba1400af778d75fa <0b3c8c39e50249470f00a5f73c288b95a55ab576; 5.16; 622ceaddb7649ca328832f50ba1400af778d75fa <604ce546e1b9f35b1f45588004f53fac6b2869c1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.