CVE-2026-89719: zram: fix out-of-bounds access in read_block_state()
In the Linux kernel, the following vulnerability has been resolved:
zram: fix out-of-bounds access in readblockstate()
readblockstate() calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old table. The subsequent loop can then call slotlock() past the end of the newly allocated table.
Read disksize after acquiring devlock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
Affected Software
Event History
Frequently Asked Questions
What runtime sequence is required for the unsafe access to occur?
A zram device must be reset and reinitialized with a smaller disksize after read_block_state() calculates its page count but before it acquires dev_lock. The later scan can then use the stale, larger count against the newly allocated table.
What does the fix change to prevent the race?
It reads disksize only after acquiring dev_lock and confirming that the device is initialized. The read lock keeps the table and its bounds stable for the scan.