CVE-2026-90043: zram: fix slot lock bit position on big-endian 64-bit
In the Linux kernel, the following vulnerability has been resolved:
zram: fix slot lock bit position on big-endian 64-bit
The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves in flags, so the aliasing works out. On 64-bit big-endian it lands in actime instead: with ZRAMTRACKENTRYACTIME enabled, storing the access time from markslotaccessed() or slotfree() wipes out the held lock bit, letting another CPU take the same slot lock; an access time value with that bit set makes the slot look locked forever.
Shift the lock bit into the flags half of the word on big-endian 64-bit.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue affects 64-bit big-endian systems using zram when ZRAM_TRACK_ENTRY_ACTIME is enabled. The lock-bit aliasing behaves correctly on little-endian systems according to the provided information.
What can happen when the affected configuration is in use?
Writing an access time can clear a slot lock that is currently held, allowing another CPU to take the same slot lock. An access-time value containing the relevant bit can also cause a slot to appear locked indefinitely.