In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the `zram_bvec_write_partial()` function allows an asynchronous read to write into a page that has already been deallocated. Such a flaw can lead to system instability, causing crashes, or in some scenarios, could be exploited by a local attacker to escalate privileges or execute arbitrary code.

A use-after-free write can occur in zram_bvec_write_partial() when zram_read_page() is called with a parent bio and selects the asynchronous backing device read path for ZRAM_WB slots. The function can return while the read bio is still in flight, after which the caller updates the temporary page, writes it back, and frees it. The pending asynchronous read may then complete into the freed page, causing kernel memory corruption. For the CVSS the PR:L is used because triggering can be possible from a local user context once zram writeback is configured, for example through swap or block I/O activity, even though initial writeback setup is usually administrative. To mitigate this issue, prevent module zram from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53185 https://nvd.nist.gov/vuln/detail/CVE-2026-53185 https://lore.kernel.org/linux-cve-announce/2026062556-CVE-2026-53185-0922@gregkh/T