CVE-2026-89717: zram: set default primary compressor in zram_destroy_comps()
In the Linux kernel, the following vulnerability has been resolved:
zram: set default primary compressor in zramdestroycomps()
Patch series "zram: fix zram issues reported by sashiko".
Sashiko drove by and reported [1] a couple of zram issues: a possible BUGON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing.
This patch (of 2):
zramdestroycomps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now compalgorithmshow()->strcmp() can be called on a NULL compressor. Set default primary compressor in zramdestroycomps().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition can trigger the NULL-pointer dereference?
The issue can occur after zram_destroy_comps() clears all compressor pointers, including the primary compressor, and comp_algorithm_show() subsequently calls strcmp() on that NULL value.
What component or configuration is affected?
The affected component is the Linux kernel zram subsystem. The data does not identify specific kernel versions, distributions, or a particular default configuration.
How is the invalid state corrected?
The fix makes zram_destroy_comps() set the primary compressor back to its default rather than leaving it NULL. This preserves a valid zram device state for later compressor-algorithm queries.