CVE-2026-98005 PUBLISHED

erofs: delimit inode_share cache key components

Assigner: Linux
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

erofs: delimit inode_share cache key components

Previously, inode_share keys were encoded as follows:

fingerprint || domain_id

It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won't be parsed as part of a domain ID.

Change the key encoding as follows:

domain_id || '\0' || fingerprint

Since domain_id is a NUL-terminated string, this makes the in-memory key indices unambiguous.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from e0bf7d1c074dc4252223ae897560345ccc24100d to 16322a67336cfeea0af4b05206ef8d0e0eda55bb (excl.)
  • affected from e0bf7d1c074dc4252223ae897560345ccc24100d to 96bf9831fbf423b8104f7948cd8fe7007ecfb46c (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 7.0 is affected
  • unaffected from 0 to 7.0 (excl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc3 to * (incl.)

References