A vulnerability in the Linux kernel EROFS driver could allow a local attacker to leak sensitive kernel memory to userspace by providing a specially crafted filesystem image.

The EROFS filesystem driver incorrectly handles interlaced ztailpacking pclusters, which are not properly validated. A local, unprivileged attacker with the ability to mount a malicious filesystem can trigger an out-of-bounds read, causing the kernel to copy sensitive memory contents into the page cache.

The ability to read arbitrary kernel memory presents a significant security risk, as it may expose cryptographic keys, credentials, or other sensitive system data. With a CVSS score of 7.1, this vulnerability is considered high severity because it facilitates information disclosure that can be leveraged to bypass kernel-level security protections.

Immediate Action: Update the Linux kernel to version 6.18.52, 7.2.6, or a later stable release where this patch has been integrated.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or filesystem-related errors that might indicate an attempt to mount or interact with corrupted or malicious EROFS images.

Compensating Controls: Restrict the ability to mount filesystems to trusted users or administrators to prevent the introduction of malicious images. Ensure that kernel hardening features, such as KASLR, are enabled to increase the difficulty of exploiting memory leaks.

Public Exploit Available: No

Given the potential for sensitive information disclosure, organizations utilizing the EROFS filesystem should prioritize patching their Linux kernel environments. Administrators should verify their current kernel version against the fixed releases and apply the necessary security updates to mitigate the risk of kernel memory exposure.