Skip to content
OpenAdvisories
Unscored CVE-2023-53777 EUVD-2023-60129GHSA-v9mq-q8m3-5r3r

erofs: kill hooked chains to avoid loops on deduplicated compressed images

Published Dec 9, 2025 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: kill hooked chains to avoid loops on deduplicated compressed images

After heavily stressing EROFS with several images which include a
hand-crafted image of repeated patterns for more than 46 days, I found
two chains could be linked with each other almost simultaneously and
form a loop so that the entire loop won't be submitted. As a
consequence, the corresponding file pages will remain locked forever.

It can be _only_ observed on data-deduplicated compressed images.
For example, consider two chains with five pclusters in total:
Chain 1: 2->3->4->5 -- The tail pcluster is 5;
Chain 2: 5->1->2 -- The tail pcluster is 2.

Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link
to Chain 2 at the same time with pcluster 2.

Since hooked chains are all linked locklessly now, I have no idea how
to simply avoid the race. Instead, let's avoid hooked chains completely
until I could work out a proper way to fix this and end users finally
tell us that it's needed to add it back.

Actually, this optimization can be found with multi-threaded workloads
(especially even more often on deduplicated compressed images), yet I'm
not sure about the overall system impacts of not having this compared
with implementation complexity.

Affected products

VendorProductAffectedFixed
Linux Linux 6.0 6.1.39

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.4.4-1 —
Debian 13 linux 6.4.4-1 —
Debian 12 linux 6.1.52-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-riscv +10 No fix yet —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.28.1 SUSE-SU-2026:0315-1
SLES 15 SP7 kernel-azure +2 6.4.0-150700.20.24.1 SUSE-SU-2026:0281-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.28.1.150700.17.19.1 SUSE-SU-2026:0315-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.84.1.150600.12.38.1 SUSE-SU-2026:0293-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 kernel-default-base 6.4.0-150600.23.84.1.150600.12.38.1 SUSE-SU-2026:0293-1
SLES for SAP 15 SP6 kernel-docs +4 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
SLE Micro 6.1 kernel-default-base 6.4.0-39.1.21.16 SUSE-SU-2026:20498-1
SLE Micro 6.1 kernel-rt +1 6.4.0-40.1 SUSE-SU-2026:20876-1
SLE Micro 6.1 kernel-source +2 6.4.0-39.1 SUSE-SU-2026:20498-1
SLE Micro 6.0 kernel-default-base 6.4.0-39.1.21.16 SUSE-SU-2026:20477-1
SLE Micro 6.0 kernel-rt +1 6.4.0-40.1 SUSE-SU-2026:20845-1
SLE Micro 6.0 kernel-source +2 6.4.0-39.1 SUSE-SU-2026:20477-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.28.1 SUSE-SU-2026:0315-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_8 1-150700.1.3.1 SUSE-SU-2026:0278-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_8 1-150700.15.3.1 SUSE-SU-2026:0315-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_19 1-150600.13.3.1 SUSE-SU-2026:0293-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.28.1 SUSE-SU-2026:0278-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +10 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.84.1.150600.12.38.1 SUSE-SU-2026:0293-1

Advisories 9

References