CVE-2026-80892: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80892 is a denial-of-service vulnerability in the Linux kernel's EROFS filesystem LZMA decompressor (fs/erofs/decompressor_lzma.c). The flaw causes the module-global MicroLZMA stream pool to be sized based on num_possible_cpus() when the lzma_streams module parameter is unset, allowing a mounted EROFS image to pin up to 8 MiB of vmalloc-backed memory per LZMA stream — potentially hundreds of MiB on high-CPU systems. The vulnerability was published on September 4, 2026, and affects Linux kernel versions from 5.16 up to the fixed releases. It carries a CVSS category estimate of Medium (GitHub Advisory, Feedly).

The root cause is an unbounded resource allocation (CWE-770: Allocation of Resources Without Limits or Throttling) in fs/erofs/decompressor_lzma.c. When the lzma_streams module parameter is not explicitly set, the stream pool is sized to num_possible_cpus(), and z_erofs_load_lzma_config() preallocates one image-supplied dictionary (up to 8 MiB each) per stream. An attacker or unprivileged user with the ability to mount an EROFS image can trigger this allocation, causing the kernel to pin excessive vmalloc memory that persists until the erofs module is unloaded. The fix introduces a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS kernel configuration option (default: 16), capping worst-case default preallocation at 128 MiB (GitHub Advisory, Feedly).

Successful exploitation results in a denial-of-service condition through kernel vmalloc memory exhaustion. On high-CPU systems, a small, specially crafted EROFS image can cause the kernel to pin hundreds of MiB of non-reclaimable vmalloc memory, degrading overall system performance and potentially causing out-of-memory conditions. The impact persists until the erofs kernel module is unloaded, and there is no confidentiality or integrity impact — the vulnerability is limited to availability (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.173%, indicating a low probability of exploitation in the near term. Exploitation requires the ability to mount an EROFS image on the target system, which may be possible for local users depending on system configuration (Feedly, GitHub Advisory).

Apply the upstream kernel patches that introduce CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS (default: 16) to cap the LZMA stream pool size. Fixed versions include: 6.1.184, 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2 (mainline). As a workaround, administrators can explicitly set the lzma_streams module parameter to a safe value (e.g., options erofs lzma_streams=16) to override the CPU-count-based default without requiring a kernel upgrade. Restricting unprivileged users from mounting EROFS images (e.g., via mount namespace controls or disabling user-namespace mounts) also reduces exposure (GitHub Advisory, Feedly).

The vulnerability was noted in coverage of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws including Linux kernel issues relevant to Windows Subsystem for Linux and Azure environments (BleepingComputer). No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond standard vulnerability database tracking.