CVE-2026-63951: zram: fix use-after-free in zram_writeback_endio

In the Linux kernel, the following vulnerability has been resolved:

zram: fix use-after-free in zramwritebackendio

A crash was observed in zramwritebackendio due to a NULL pointer dereference in wakeup. The root cause is a race condition between the bio completion handler (zramwritebackendio) and the writeback task.

In zramwritebackendio, wakeup() is called on &wbctl->donewait after releasing wbctl->donelock. This creates a race window where the writeback task can see numinflight become 0, return, and free wbctl before zramwritebackendio calls wakeup().

CPU 0 (zramwritebackendio) CPU 1 (writebackstore) ============================ ============================ zramwritebackslots zramsubmitwbrequest zramsubmitwbrequest waitevent(wbctl->donewait) spinlock(&wbctl->donelock); listadd(&req->entry, &wbctl->donereqs); spinunlock(&wbctl->donelock); wakeup(&wbctl->donewait); zramcompletedonereqs spinlock(&wbctl->donelock); listadd(&req->entry, &wbctl->donereqs); spinunlock(&wbctl->donelock); while (numinflight) > 0) spinlock(&wbctl->donelock); listdel(&req->entry); spinunlock(&wbctl->donelock); // numinflight becomes 0 atomicdec(numinflight);

// Leave zramwritebackslots // Free wbctl releasewbctl(wbctl); // UAF crash! wakeup(&wbctl->donewait);

This patch fixes this race by using RCU. By protecting wbctl with rcureadlock() in zramwritebackendio and using kfreercu() to free it, we ensure that wbctl remains valid during the execution of zramwritebackendio.