AZL-99555
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99555.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99555
- Upstream
- Published
- 2026-09-04T18:17:57Z
- Modified
- 2026-09-06T05:31:44Z
- Summary
- CVE-2026-80892 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
erofs: cap LZMA stream pool size
fs/erofs/decompressorlzma.c sizes the module-global MicroLZMA stream pool from numpossiblecpus() when the lzmastreams module parameter is unset, then zerofsloadlzmaconfig() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new CONFIGEROFSFSZIPLZMADEFAULTMAXSTREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzmastreams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.
- References