CVE-2026-89717: zram: set default primary compressor in zram_destroy_comps()
In the Linux kernel, the following vulnerability has been resolved:
zram: set default primary compressor in zramdestroycomps()
Patch series "zram: fix zram issues reported by sashiko".
Sashiko drove by and reported [1] a couple of zram issues: a possible BUGON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing.
This patch (of 2):
zramdestroycomps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now compalgorithmshow()->strcmp() can be called on a NULL compressor. Set default primary compressor in zramdestroycomps().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (zram)to a version that resolves this vulnerability.Patch Patch series "zram: fix zram issues reported by sashiko" - Configuration
Apply the patch series "zram: fix zram issues reported by sashiko", which sets the default primary compressor in zram_destroy_comps() (zram_destroy_comps() resets all compressors and leaves them set to NULL otherwise), preventing invalid device state and NULL-ptr/BUG_ON issues referenced in the report.
zram (zlib/zcomp within Linux kernel) default primary compressor in zram_destroy_comps() = Set default primary compressor in zram_destroy_comps() so compressors are properly validated and not left in an invalid device state (avoid NULL state).
Event History
Frequently Asked Questions
What condition can trigger the NULL-pointer dereference?
The issue can occur after zram_destroy_comps() clears all compressor pointers, including the primary compressor, and comp_algorithm_show() subsequently calls strcmp() on that NULL value.
What component or configuration is affected?
The affected component is the Linux kernel zram subsystem. The data does not identify specific kernel versions, distributions, or a particular default configuration.
How is the invalid state corrected?
The fix makes zram_destroy_comps() set the primary compressor back to its default rather than leaving it NULL. This preserves a valid zram device state for later compressor-algorithm queries.