CVE-2026-89719

zram: fix out-of-bounds access in read_block_state()

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

zram: fix out-of-bounds access in read_block_state()

read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table.

Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before fee53224c8261541cf310b57ac7c77a80e144483Affected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 26a55336be91004dbd438f3b89b0c31617459976Affected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before a189cae92e97d90a9553740f5558d6f74446d3d1Affected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before f5e9f3a75efc774f17ab3f33826630d7fe30c7eaAffected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 6d52c1f43ff39ea1ebf8f016e847677f0b60cf2bAffected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739dAffected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3Affected c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 391f057f44a51cc9418da5cba78b014324174264Affected
LinuxLinux	4.18Affected before 4.18Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before fee53224c8261541cf310b57ac7c77a80e144483Affected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 26a55336be91004dbd438f3b89b0c31617459976Affected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before a189cae92e97d90a9553740f5558d6f74446d3d1Affected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before f5e9f3a75efc774f17ab3f33826630d7fe30c7eaAffected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 6d52c1f43ff39ea1ebf8f016e847677f0b60cf2bAffected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739dAffected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3Affected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to before 391f057f44a51cc9418da5cba78b014324174264Affected

LinuxLinux

4.18Affected
before 4.18Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.