CVE-2023-52526

What it actually does

The flaw is an unreleased temporary page allocation in the EROFS microLZMA deduplication path that accumulates under load and eventually triggers OOM conditions.

Why it matters to the business

Systems running affected kernels with the deduplication feature enabled can experience gradual memory exhaustion and unexpected crashes hours after normal operation begins, leading to unplanned downtime and potential data loss.

How an attack unfolds

An attacker with the ability to supply or trigger mounting of specially prepared EROFS images containing the global compressed deduplication feature can repeatedly exercise the leaky code path, causing progressive memory consumption until the system becomes unresponsive or crashes.

How to fix it

Update the Linux kernel to a version containing commit 6a5a8f0a9740f865693d5aa97a42cc4504538e18 or later; disable the -Ededupe option for EROFS images until the update is applied.

How to confirm the fix worked

Verify the running kernel contains commit 6a5a8f0a9740f865693d5aa97a42cc4504538e18; confirm that mounting and stressing EROFS images with deduplication no longer produces steadily increasing unreclaimed page counts via slabinfo or /proc/meminfo monitoring.

Typical attack path

1. Obtain or craft an EROFS filesystem image that uses microLZMA compression with global deduplication enabled.
2. Cause the target system to mount the image (via local access, container image, or network share).
3. Repeatedly stress the mount point to trigger repeated allocation of short-lived pages that are never freed.
4. Monitor until kernel memory exhaustion produces OOM kills or system instability.

How to detect it

Review kernel logs for repeated allocation failures or OOM killer activity correlated with EROFS mount operations; monitor memory usage trends on systems known to use EROFS deduplication images.

What your security team should do

• Prioritize kernel upgrades on any systems that mount EROFS images with deduplication enabled.
• Temporarily avoid use of the deduplication feature until patches are deployed.
• Add kernel version checks to image build and deployment pipelines.