CVE-2026-89719
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-11 20:20:00.820000
Last modified
2026-10-30 13:20:27.580000
View original CVE JSON
{
"id": "CVE-2026-89719",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-11T20:20:00.820",
"lastModified": "2026-10-30T13:20:27.580",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in read_block_state()\n\nread_block_state() calculates nr_pages before taking dev_lock. If the\ndevice is reset and reinitialized with a smaller disksize before lock\nacquisition, nr_pages still describes the old table. The subsequent loop\ncan then call slot_lock() past the end of the newly allocated table.\n\nRead disksize after acquiring dev_lock and checking that the device is\ninitialized. The read lock then keeps the table and its bound stable for\nthe duration of the scan."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "fee53224c8261541cf310b57ac7c77a80e144483",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "26a55336be91004dbd438f3b89b0c31617459976",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "a189cae92e97d90a9553740f5558d6f74446d3d1",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "f5e9f3a75efc774f17ab3f33826630d7fe30c7ea",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "6d52c1f43ff39ea1ebf8f016e847677f0b60cf2b",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739d",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3",
"versionType": "git",
"status": "affected"
},
{
"version": "c0265342bff4fcaa2cdf13f4596244c18d4a7ae5",
"lessThan": "391f057f44a51cc9418da5cba78b014324174264",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.18",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.18",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.51",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.4",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/26a55336be91004dbd438f3b89b0c31617459976",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/391f057f44a51cc9418da5cba78b014324174264",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6d52c1f43ff39ea1ebf8f016e847677f0b60cf2b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a189cae92e97d90a9553740f5558d6f74446d3d1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5e9f3a75efc774f17ab3f33826630d7fe30c7ea",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fee53224c8261541cf310b57ac7c77a80e144483",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}