CVE-2026-89718 (GCVE-0-2026-89718)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-21 12:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback_store() Patch series "zram: fix stale scan bounds after reinitialization". Both writeback_store() and read_block_state() derive their table scan bounds from zram->disksize before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize between that read and lock acquisition, the bound can describe the old table while the scan operates on the new one. This can lead to out-of-bounds slot accesses. Move both bound calculations under dev_lock so each bound remains consistent with the table throughout its scan. Keep the fixes separate because the affected interfaces originate from different commits and can be backported independently. This patch (of 2): writeback_store() calculates the table scan bounds before taking dev_lock. A reset followed by reconfiguration with a smaller disksize can therefore replace zram->table while writeback_store() is waiting for the lock. Once it acquires the lock, it sees an initialized device but scans the new table using the old upper bound, resulting in an out-of-bounds access. Calculate the number of pages while holding dev_lock so the scan bound matches the table protected by the lock.
References
Impacted products
Vendor Product Version
Linux Linux Version: a939888ec38bf1f33e4a903056677e92a4844244
Version: a939888ec38bf1f33e4a903056677e92a4844244
Version: a939888ec38bf1f33e4a903056677e92a4844244
Version: a939888ec38bf1f33e4a903056677e92a4844244
Version: a939888ec38bf1f33e4a903056677e92a4844244
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c2745e657f0974871fbc60d46d48c2b04e581330",
              "status": "affected",
              "version": "a939888ec38bf1f33e4a903056677e92a4844244",
              "versionType": "git"
            },
            {
              "lessThan": "4d82d60178b02797dbe529e01ac211b26670c49f",
              "status": "affected",
              "version": "a939888ec38bf1f33e4a903056677e92a4844244",
              "versionType": "git"
            },
            {
              "lessThan": "ef073edd7cfd31aeb90eeab23273102c601f4d8e",
              "status": "affected",
              "version": "a939888ec38bf1f33e4a903056677e92a4844244",
              "versionType": "git"
            },
            {
              "lessThan": "07a82a66f8c1894d92e51d97542c32ebf2c51b09",
              "status": "affected",
              "version": "a939888ec38bf1f33e4a903056677e92a4844244",
              "versionType": "git"
            },
            {
              "lessThan": "894913e2d35c46ff19a77530907771ae57862b96",
              "status": "affected",
              "version": "a939888ec38bf1f33e4a903056677e92a4844244",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in writeback_store()\n\nPatch series \"zram: fix stale scan bounds after reinitialization\".\n\nBoth writeback_store() and read_block_state() derive their table scan\nbounds from zram-\u003edisksize before acquiring dev_lock.  If the device is\nreset and reinitialized with a smaller disksize between that read and lock\nacquisition, the bound can describe the old table while the scan operates\non the new one.  This can lead to out-of-bounds slot accesses.\n\nMove both bound calculations under dev_lock so each bound remains\nconsistent with the table throughout its scan.  Keep the fixes separate\nbecause the affected interfaces originate from different commits and can\nbe backported independently.\n\n\nThis patch (of 2):\n\nwriteback_store() calculates the table scan bounds before taking dev_lock.\nA reset followed by reconfiguration with a smaller disksize can therefore\nreplace zram-\u003etable while writeback_store() is waiting for the lock.  Once\nit acquires the lock, it sees an initialized device but scans the new\ntable using the old upper bound, resulting in an out-of-bounds access.\n\nCalculate the number of pages while holding dev_lock so the scan bound\nmatches the table protected by the lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:29.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c2745e657f0974871fbc60d46d48c2b04e581330"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d82d60178b02797dbe529e01ac211b26670c49f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef073edd7cfd31aeb90eeab23273102c601f4d8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/07a82a66f8c1894d92e51d97542c32ebf2c51b09"
        },
        {
          "url": "https://git.kernel.org/stable/c/894913e2d35c46ff19a77530907771ae57862b96"
        }
      ],
      "title": "zram: fix out-of-bounds access in writeback_store()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89718",
    "datePublished": "2026-09-11T19:46:31.443Z",
    "dateReserved": "2026-09-11T19:38:34.752Z",
    "dateUpdated": "2026-10-21T12:48:29.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.