CVE-2026-53015: Linux Kernel EROFS 32-bit Logical Cluster Number Truncation

Technical summary

The EROFS driver in the Linux kernel used a 32-bit `unsigned long` (or sometimes `unsigned int`) variable named `lcn` (logical cluster number) throughout its codebase. When this value is left-shifted by `lclusterbits` (typically 12–16 bits), the operation can overflow on 32-bit architectures, truncating the result at the 4 GiB boundary. The fix involves changing all `lcn` declarations and operations to use the 64-bit `u64` type, ensuring that large cluster numbers and their shifted equivalents remain accurate regardless of platform word size. This is a straightforward type consolidation that eliminates a silent data corruption vector.

Business impact

On systems running 32-bit Linux kernels with EROFS filesystems, this bug could lead to data corruption or incorrect file access when the filesystem contains data that maps to logical addresses beyond 4 GiB. Organizations relying on 32-bit embedded or specialized systems (IoT, legacy hardware, or containers) with EROFS may experience silent data loss or unpredictable filesystem behavior. The impact is most acute in scenarios where large files or high-capacity storage devices are accessed on 32-bit platforms.

Affected systems

The vulnerability affects the Linux kernel's EROFS implementation across all versions prior to the patch. The practical impact is limited to systems running 32-bit kernels (32-bit ARM, x86, or other 32-bit architectures) that use EROFS as the root or data filesystem. 64-bit systems are unaffected because the truncation only manifests when `unsigned long` is 32 bits wide. Embedded systems, IoT devices, and legacy platforms using 32-bit kernels with EROFS are at highest risk.

Exploitability

This vulnerability requires no user interaction and no special privileges—it is automatically triggered when the filesystem attempts to access logical clusters at or beyond the 4 GiB boundary. A local attacker could potentially craft a malicious EROFS image or trigger the condition through normal file operations on a filesystem that spans the 4 GiB threshold, causing denial of service or data corruption. The fix is patched in the kernel source; the bug is not easily weaponized from user space but is passively exploitable through normal filesystem operations on vulnerable configurations.

Remediation

Apply the kernel patch that unifies `lcn` to `u64` across all EROFS code paths. This involves updating type declarations and ensuring all operations using `lcn` are consistent with the 64-bit type. Verify the patch against your kernel version and configuration, particularly if you maintain a 32-bit kernel build. Recompile and redeploy the patched kernel to affected systems. Organizations using only 64-bit kernels do not require action.

Patch guidance

Consult your Linux distribution's security advisory and kernel source repository for the specific patch version and backport status. The upstream fix appears in kernel versions that incorporate the EROFS type consolidation. Verify that your 32-bit kernel build includes this patch by checking the kernel release notes or git log for references to EROFS `lcn` type changes. If you compile your own kernel, apply the patch directly from the Linux kernel mailing list or your distribution's patch repository before recompiling. Test thoroughly on 32-bit test systems with EROFS before production deployment.

Detection guidance

Monitor kernel logs for EROFS-related errors or warnings on 32-bit systems accessing large files or high-capacity filesystems. Conduct a filesystem audit to identify whether EROFS is in use and, if so, whether any data resides or is accessed beyond 4 GiB logical addresses. Check kernel version and EROFS build configuration to confirm vulnerability status. Performance anomalies, unexpected I/O errors, or data corruption on 32-bit systems with EROFS warrant investigation and immediate patching.

Why prioritize this

Although the CVSS score is 5.5 (Medium), the practical impact depends heavily on deployment architecture. Organizations running 32-bit kernels with EROFS on production systems should prioritize this patch to prevent silent data corruption. The vulnerability is low-visibility because it manifests as filesystem corruption rather than a security breach, yet the consequences can be severe if large files are silently corrupted. Conversely, organizations using exclusively 64-bit kernels can safely defer this patch.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects an attack requiring local access with low privilege, no user interaction, and resulting in availability impact (denial of service through data corruption). The score does not account for integrity impact because the vulnerability manifests primarily as availability loss, though data integrity is at risk in practice. Organizations with 32-bit deployments should treat this as higher priority than the numeric score suggests due to the non-recoverable nature of silent data corruption.

Frequently asked questions