Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-89719

zram: fix out-of-bounds access in read_block_state()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.6.160, 6.12.111, 6.18.51, 7.2.4
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    4.18

  • KernelLinux

    From 4.18.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.4

References 8

git.kernel.org