CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial()
In the Linux kernel, the following vulnerability has been resolved:
zram: fix use-after-free in zrambvecwritepartial()
zramreadpage() picks the sync or async backing device read path based on whether the parent bio is NULL. zrambvecwritepartial() passes its parent bio down, so for ZRAMWB slots the read is dispatched asynchronously and zramreadpage() returns 0 while the bio is still in flight. The caller then runs memcpyfrombvec(), zramwritepage() and freepage() on the buffer, leaving the async read to write into a freed page.
zrambvecreadpartial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the writepartial counterpart was missed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel zramto a version that resolves this vulnerability.Fixed in 4e3c87b9421d - Configuration
Patch the kernel to include the resolution of the ZRAM use-after-free in zram_bvec_write_partial(), which was caused by memcpy_from_bvec()/zram_write_page()/__free_page() leaving an async read to write into a freed buffer while zram_read_page() returns 0; incorporate the missing counterpart missed after the NULL switch in zram_bvec_read_partial() (commit 4e3c87b9421d).
Linux kernel zram zram_bvec_write_partial() / zram_bvec_read_partial() buffer handling = Apply the fix for the use-after-free described (ensure the freed buffer is not used by the async read and missed counterpart is handled)
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The CVSS vector indicates local access is required, with low privileges and no user interaction. It does not indicate a network-accessible attack path.
What is the potential security impact if exploitation succeeds?
The CVSS assessment rates confidentiality, integrity, and availability impact as high. The use-after-free occurs when an asynchronous backing-device read can write to a page after that page has been freed.