CVE-2026-90161

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the erofs filesystem where interlaced pclusters (physical clusters) with ztailpacking enabled are considered invalid. While standard tools do not generate such clusters, a specially crafted image can contain them, leading to an out-of-bounds read from a kmap'd page. This allows irrelevant kernel memory to be copied into the page cache, which is visible to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.