CVE-2026-89719
Description
A flaw was found in the Linux kernel's zram module. This vulnerability occurs when the read_block_state() function calculates the number of pages before acquiring a device lock. If the zram device is reset and reinitialized with a smaller disk size, the function can attempt to access memory beyond the bounds of the newly allocated table. This out-of-bounds access can lead to system instability or a denial of service (DoS).
Statement
A race in zram read_block_state can calculate nr_pages from the old disksize before dev_lock is acquired. If the device is reset and reinitialized with a smaller disksize before the lock is taken, the later scan can use the stale larger bound and call slot_lock past the end of the newly allocated zram table. This is a local race condition and an out of bounds access candidate rather than a network reachable bug. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate zram or debugfs control to a reduced capability root, container root, or service account rather than full host administration. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact because slot locking past the table boundary can touch memory outside the intended allocation.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
