CVE-2026-98067

Executive Summary

CVE-2026-98067 is a data correctness flaw in the Linux kernel erofs (Enhanced Read-Only File System) subsystem. The LZ4 rolling decompression optimization violates its own bounded window assumption because the upstream LZ4 implementation may copy literals backward, causing incorrect decompressed data to be read from specially crafted compressed EROFS images. Any Linux system that mounts attacker-controlled or corrupted EROFS images is potentially affected, and the impact centers on integrity and availability of data/file reads rather than a straightforward remote code execution path.

Technical Analysis

The vulnerability is rooted in the EROFS LZ4 rolling decompression feature, which was introduced to reduce the memory footprint of temporary pages used during decompression. Rolling decompression relies on the LZ77 property of LZ4: since LZ4 back-references only the most recent 64 KiB of already-decompressed data, only a bounded rolling window of temporary pages should be required to decompress a compressed extent (pcluster).

The design assumes that this window remains consistent and that decompression writes do not propagate outside the expected recent-data region. That assumption is broken by the upstream LZ4 implementation. Specifically, the literal copy routine, implemented via memmove(), may copy long literals backward on x86 based on an address comparison even when the source and destination ranges do not actually overlap. When such a backward copy occurs, the rolling assumption is invalidated because the decompression process no longer respects the intended bounded window, and data correctness is compromised.

The upstream resolution is simply to disable LZ4 rolling decompression "for now" to prioritize data correctness, with the noted intention to revive the rolling-window approach once the official LZ4 behavior can be guaranteed. The precise errata detail is that "the upstream LZ4 implementation is not under EROFS' control," so the kernel cannot enforce the memory-safety invariant the optimization depends on.

Because the description ends mid-sentence ("once we either ensure that the official "), insufficient technical detail is available regarding the exact data corruption pattern, the exact kernel version range affected, or whether memory corruption beyond incorrect decompression output is possible. Based strictly on the available text, the class is an incorrect-decompression / data-correctness defect in a filesystem decompression path, arising from an optimization whose safety precondition is violated by a lower-level library routine.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-98067. The following is a vulnerability-class level inference and must not be read as a verified exploit chain.

1. Reconnaissance/target identification: An attacker identifies a system that will mount an EROFS image under attacker influence, such as container images, embedded/read-only root filesystems, or firmware/OTA payloads distributed as EROFS. The attacker needs the ability to supply or modify the image before it is mounted.

2. Trigger: When a process performs a small or partial read within a compressed pcluster, or when uptodate order-0 folios cannot be reused for decompression, the kernel invokes LZ4 rolling decompression to save temporary pages. If the image is crafted so that the LZ4 literal copy path causes a backward memmove() on x86, the rolling-window assumption is violated and decompression produces incorrect output within the bounded window.

3. Payload/execution method: The "payload" is the crafted EROFS compressed image itself — the flaw is reached through normal filesystem read operations against that image. No specific kernel function names, syscall parameters, or file paths are available from the description to describe this more concretely, and none are fabricated here.

4. Post-exploitation impact: The immediate effect is incorrect data being returned to readers. Depending on what the corrupted data represents (configuration, binary content, or integrity-checked payloads), consequences could include integrity loss, application malfunction, or service instability/denial of service. Whether the corruption can be leveraged into privilege escalation cannot be determined from the available description.

Impact Assessment

The vulnerability affects the integrity of data read from EROFS mounts whenever LZ4 rolling decompression is used. Because the fix is to disable the optimization, the practical affected scope is limited to kernels that ship the rolling decompression feature; the report's supplied affected-version list is empty, so no specific kernel range can be asserted.

CVSS is not officially assigned (N/A in the intelligence data). The vector proposed in METADATA (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local attack vector requiring a crafted image and specific conditions to trigger the bad copy path, yielding a high integrity impact and a high availability impact. This is an analytic placeholder, not a vendor score, and should not be treated as authoritative.

Business impact centers on platforms relying on EROFS for immutable/read-only filesystems: container hosts and orchestrators, embedded Linux devices, mobile/consumer devices, and OTA update pipelines. Blast radius is bounded by the set of systems that can be induced to mount a malicious or corrupted EROFS image and then perform reads that hit the rolling decompression path. Because the flaw is in a widely used kernel filesystem, the strategic risk is greater than the immediate exploitability: silent data corruption in a read-only filesystem is hard to detect and can persist across boots.

Detection Guidance

Sigma Rule

title: Linux EROFS LZ4 Rolling Decompression Corruption Attempt
id: 5c9c1f8a-9806-7b1e-4f2a-erofs98067
status: experimental
description: Detects EROFS mounts followed by abnormal read errors/corruption indicators
author: valtersit.com Threat Intelligence
logsource:
  product: linux
  service: kernel
detection:
  selection_mount:
    message|contains:
      - 'erofs'
      - 'EROFS'
  selection_err:
    message|contains:
      - 'decompression error'
      - 'corrupted'
      - 'invalid compressed'
  condition: selection_mount and selection_err
falsepositives:
  - Legitimate EROFS media errors
level: medium
tags:
  - attack.t1499
  - cve.2026.98067

YARA Rule

rule CVE_2026_98067_EROFS_LZ4_Rolling
{
    meta:
        description = "Detects EROFS LZ4 compressed image markers potentially affected by rolling decompression flaw"
        author = "valtersit.com Threat Intelligence"
        reference = "CVE-2026-98067"
        date = "2026-01-01"
    strings:
        $erofs_magic = { E2 E1 F5 E0 }
        $lz4 = "LZ4" ascii nocase
        $erofs = "erofs" ascii nocase
    condition:
        $erofs_magic at 1024 and ($lz4 or $erofs)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98067 EROFS image transfer (possible malicious mount payload)"; flow:to_server,established; content:"|E2 E1 F5 E0|"; offset:1024; depth:4; classtype:attempted-user; sid:2026098067; rev:1; reference:cve,2026-98067;)

Elastic Detection

process where host.os.type == "linux" and event.action == "mounted" and process.name in ("mount","losetup")
and process.args : "*erofs*"

Splunk SPL Query

index=linux sourcetype=syslog ("erofs" OR "EROFS") ("decompression" OR "corrupt" OR "invalid compressed" OR "LZ4")
| stats count by host, message
| where count > 0

Wazuh OSSEC Rule

<group name="linux,erofs,CVE-2026-98067,">
  <rule id="980671" level="7">
    <decoded_as>syslog</decoded_as>
    <match>erofs|EROFS</match>
    <description>CVE-2026-98067: EROFS LZ4 decompression error or anomalous EROFS mount detected</description>
    <group>cve_2026_98067,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected/fixed version data is tracked for CVE-2026-98067.

1. Immediate mitigations

• Do not mount EROFS images from untrusted or untrusted-transport sources; validate image provenance and integrity before mounting.
• Where practical, disable use of the LZ4 rolling decompression path if the running kernel exposes a relevant mount/config option; note that the upstream resolution was to disable the optimization by default.
• Isolate systems that mount externally supplied EROFS images and treat EROFS image transport as a sensitive operation.

2. Patch/upgrade steps

• Apply the upstream kernel change that disables EROFS LZ4 rolling decompression as soon as it is available in your distribution's kernel package. Because the fix is a disable-by-default change rather than a replacement algorithm, ensure the specific kernel version includes that change.
• Rebuild any embedded/container base images after upgrading the kernel or EROFS tooling so that affected paths are no longer reachable.

3. Long-term hardening

• Treat read-only filesystem images as code: sign and verify EROFS images before use.
• Monitor for erofs decompression errors and unexpected mount activity as corruption indicators.
• Track upstream LZ4 and EROFS changes, since correctness now depends on external LZ4 behavior; revisit the rolling-window optimization only when the upstream LZ4 semantics are guaranteed.

References

• NVD — CVE-2026-98067: https://nvd.nist.gov/vuln/detail/CVE-2026-98067
• Linux kernel EROFS documentation: https://docs.kernel.org/filesystems/erofs.html
• Upstream Linux kernel git (erofs commits): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
• LZ4 reference implementation: https://github.com/lz4/lz4
• No known threat actor campaigns or exploit-in-the-wild evidence identified at time of writing.