CVE-2026-80892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

erofs: cap LZMA stream pool size

fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream

pool from num_possible_cpus() when the lzma_streams module parameter is

unset, then z_erofs_load_lzma_config() preallocates one image-supplied

dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU

systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed

decoder state until the erofs module is unloaded.

Impact: An EROFS image mounted by the system can pin up to 8 MiB of

vmalloc memory per LZMA stream, either as intended or unexpectedly.

Bound the default stream count by a new

CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the

worst-case default preallocation is 128 MiB if the number of CPUs is no

less than 16 while preserving the existing per-image dictionary limit.

An explicit lzma_streams module parameter is still honoured as-is, so

administrators who deliberat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References