CVE-2026-89719 (GCVE-0-2026-89719)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-21 12:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
References
Impacted products
Vendor Product Version
Linux Linux Version: c0265342bff4fcaa2cdf13f4596244c18d4a7ae5
Version: c0265342bff4fcaa2cdf13f4596244c18d4a7ae5
Version: c0265342bff4fcaa2cdf13f4596244c18d4a7ae5
Version: c0265342bff4fcaa2cdf13f4596244c18d4a7ae5
Version: c0265342bff4fcaa2cdf13f4596244c18d4a7ae5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5e9f3a75efc774f17ab3f33826630d7fe30c7ea",
              "status": "affected",
              "version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
              "versionType": "git"
            },
            {
              "lessThan": "6d52c1f43ff39ea1ebf8f016e847677f0b60cf2b",
              "status": "affected",
              "version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
              "versionType": "git"
            },
            {
              "lessThan": "e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739d",
              "status": "affected",
              "version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
              "versionType": "git"
            },
            {
              "lessThan": "5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3",
              "status": "affected",
              "version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
              "versionType": "git"
            },
            {
              "lessThan": "391f057f44a51cc9418da5cba78b014324174264",
              "status": "affected",
              "version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in read_block_state()\n\nread_block_state() calculates nr_pages before taking dev_lock.  If the\ndevice is reset and reinitialized with a smaller disksize before lock\nacquisition, nr_pages still describes the old table.  The subsequent loop\ncan then call slot_lock() past the end of the newly allocated table.\n\nRead disksize after acquiring dev_lock and checking that the device is\ninitialized.  The read lock then keeps the table and its bound stable for\nthe duration of the scan."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:30.287Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5e9f3a75efc774f17ab3f33826630d7fe30c7ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d52c1f43ff39ea1ebf8f016e847677f0b60cf2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3"
        },
        {
          "url": "https://git.kernel.org/stable/c/391f057f44a51cc9418da5cba78b014324174264"
        }
      ],
      "title": "zram: fix out-of-bounds access in read_block_state()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89719",
    "datePublished": "2026-09-11T19:46:32.185Z",
    "dateReserved": "2026-09-11T19:38:34.752Z",
    "dateUpdated": "2026-10-21T12:48:30.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.