CVE-2026-89552: params: fix charp corruption on allocation failure
In the Linux kernel, the following vulnerability has been resolved:
params: fix charp corruption on allocation failure
paramsetcharp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated.
The previous value is released before the replacement allocation succeeds. If kmallocparameter() fails, the setter returns -ENOMEM with the parameter left as NULL.
Failing zswap's compressor update before zswap is initialized can later trigger:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:strcmp+0x10/0x30 Call Trace: zswapsetup+0x3b1/0x490 zswapenabledparamset+0x5b/0xa0 paramattrstore+0x93/0xe0 moduleattrstore+0x1c/0x30 kernfsfopwriteiter+0x116/0x1f0
Allocate and copy the replacement first, then replace the parameter value only after allocation succeeds.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the observed kernel crash?
A charp parameter update must fail because kmalloc_parameter() cannot allocate the replacement value after the existing value has been released. In the reported case, a failed update of zswap's compressor before zswap initialization leaves the parameter NULL, and later zswap initialization dereferences it through strcmp().
What state is left behind after a failed parameter update?
The setter returns -ENOMEM and leaves the affected parameter as NULL because it releases the previous value before allocating the replacement. This can convert an allocation failure during an update into a later NULL pointer dereference when the parameter is used.
How does the resolved change prevent the issue?
The replacement parameter value is allocated and copied before the existing value is replaced. If allocation fails, the prior parameter value remains intact rather than being cleared to NULL.