UBUNTU-CVE-2026-90043: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves in flags, so the aliasing works out. On 64-bit big-endian it lands in actime instead: with ZRAMTRACKENTRYACTIME enabled, storing the access time from markslotaccessed() or slotfree() wipes out the held lock bit, letting another CPU take the same slot lock; an access time value with that bit set makes the slot look locked forever. Shift the lock bit into the flags half of the word on big-endian 64-bit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects 64-bit big-endian systems using zram when ZRAM_TRACK_ENTRY_ACTIME is enabled. The listed Ubuntu kernel packages are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What level of access does an attacker need?
The supplied severity vector indicates local access and low privileges are required, with no user interaction required. It rates the potential impact as high for confidentiality, integrity, and availability.
How can I determine whether a system is potentially affected?
Verify that the system is running one of the listed kernel packages on a 64-bit big-endian platform, uses zram, and has ZRAM_TRACK_ENTRY_ACTIME enabled. The provided data does not include affected or fixed package versions.
What is the relevant configuration condition if patching cannot happen immediately?
The described lock corruption occurs when ZRAM_TRACK_ENTRY_ACTIME is enabled on 64-bit big-endian systems. The data does not provide a tested workaround or configuration-change procedure.